Overview

overview

10

Static

static

7

SmBRfCiH.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2024, 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SmBRfCiH.exe

  • Size

    27.9MB

  • MD5

    34e055a67b10a1a14994b6b3457698e2

  • SHA1

    6b299dca56f55a0656b23fd035f4353dc049343a

  • SHA256

    01b6ee7d4a8b358ef51e4f2d19f75ff4de4d4acab7c56f2a3063e4b35847dd09

  • SHA512

    8437dde18940cf8197d25f729bbaaf0803b81ffa1ed13128c91e6e3a65f01fc8253a19badc6e71c187928832dbabb03cf45ddc392e19e4c5dc6f741ada13d218

  • SSDEEP

    786432:PPhOXo+/5eJC7HRCyM1yMRUEvTHBfBRcda3:3AY+/4JOlQ7PRco3

Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomwarethemidatrojan

Malware Config

Signatures

  • Deletes NTFS Change Journal 2 TTPs 64 IoCs

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 19 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 54 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Boot or Logon Autostart Execution: Time Providers 1 TTPs 32 IoCs

    The Windows Time service (W32Time) enables time synchronization across and within domains.

    persistence
  • Drops file in Windows directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 64 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SmBRfCiH.exe
    "C:\Users\Admin\AppData\Local\Temp\SmBRfCiH.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command Remove-Item 'C:\Users\Admin\AppData\Local\Temp\SmBRfCiH.exe.bak' -force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\SYSTEM32\net.exe
      net stop w32time
      2⤵
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:428
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop w32time
        3⤵
        • System Time Discovery
        PID:5040
    • C:\Windows\SYSTEM32\w32tm.exe
      w32tm /unregister
      2⤵
        PID:796
      • C:\Windows\SYSTEM32\w32tm.exe
        w32tm /register
        2⤵
        • Server Software Component: Terminal Services DLL
        • Boot or Logon Autostart Execution: Time Providers
        PID:2712
      • C:\Windows\SYSTEM32\net.exe
        net start w32time
        2⤵
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:1120
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 start w32time
          3⤵
          • System Time Discovery
          PID:3456
      • C:\Windows\SYSTEM32\fsutil.exe
        fsutil behavior set disablelastaccess 1
        2⤵
          PID:3224
        • C:\Windows\SYSTEM32\sc.exe
          sc stop "PcaSvc"
          2⤵
          • Launches sc.exe
          PID:1596
        • C:\Windows\SYSTEM32\sc.exe
          sc config "PcaSvc" start=disabled
          2⤵
            PID:3704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Drops file in Windows directory
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4684
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get VirtualizationFirmwareEnabled
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "confirm-securebootuefi"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3408
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "Get-WmiObject -Namespace 'Root\CIMv2\Security\MicrosoftTpm' -Class Win32_Tpm"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command "$env:firmware_type"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:808
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2564
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2732
          • C:\Windows\SYSTEM32\w32tm.exe
            w32tm /resync /force
            2⤵
              PID:3584
            • C:\Windows\SYSTEM32\fsutil.exe
              fsutil usn deletejournal /d C:
              2⤵
              • Deletes NTFS Change Journal
              PID:3136
            • C:\Windows\SYSTEM32\fsutil.exe
              fsutil usn deletejournal /d D:
              2⤵
              • Deletes NTFS Change Journal
              • Enumerates connected drives
              PID:4572
            • C:\Windows\SYSTEM32\fsutil.exe
              fsutil usn deletejournal /d F:
              2⤵
              • Deletes NTFS Change Journal
              • Enumerates connected drives
              PID:4900
            • C:\Windows\SYSTEM32\sc.exe
              sc stop "SysMain"
              2⤵
                PID:1384
              • C:\Windows\SYSTEM32\sc.exe
                sc config "SysMain" start=disabled
                2⤵
                  PID:1160
                • C:\Windows\SYSTEM32\sc.exe
                  sc stop "SuperFetch"
                  2⤵
                  • Launches sc.exe
                  PID:2148
                • C:\Windows\SYSTEM32\sc.exe
                  sc config "SuperFetch" start=disabled
                  2⤵
                  • Launches sc.exe
                  PID:3660
                • C:\Windows\SYSTEM32\net.exe
                  net stop w32time
                  2⤵
                  • System Time Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2476
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop w32time
                    3⤵
                    • System Time Discovery
                    PID:1600
                • C:\Windows\SYSTEM32\fsutil.exe
                  fsutil behavior set disablelastaccess 1
                  2⤵
                    PID:3256
                  • C:\Windows\SYSTEM32\sc.exe
                    sc stop "PcaSvc"
                    2⤵
                    • Launches sc.exe
                    PID:5024
                  • C:\Windows\SYSTEM32\sc.exe
                    sc config "PcaSvc" start=disabled
                    2⤵
                      PID:64
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                      2⤵
                      • Hide Artifacts: Ignore Process Interrupts
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4504
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:2564
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                        2⤵
                        • Hide Artifacts: Ignore Process Interrupts
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1820
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                        2⤵
                        • Hide Artifacts: Ignore Process Interrupts
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2928
                      • C:\Windows\SYSTEM32\fsutil.exe
                        fsutil usn deletejournal /d C:
                        2⤵
                        • Deletes NTFS Change Journal
                        PID:3744
                      • C:\Windows\SYSTEM32\fsutil.exe
                        fsutil usn deletejournal /d D:
                        2⤵
                        • Enumerates connected drives
                        PID:4368
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:2712
                        • C:\Windows\SYSTEM32\fsutil.exe
                          fsutil usn deletejournal /d F:
                          2⤵
                          • Deletes NTFS Change Journal
                          • Enumerates connected drives
                          PID:2936
                        • C:\Windows\SYSTEM32\sc.exe
                          sc stop "SysMain"
                          2⤵
                            PID:3800
                          • C:\Windows\SYSTEM32\sc.exe
                            sc config "SysMain" start=disabled
                            2⤵
                              PID:3664
                            • C:\Windows\SYSTEM32\sc.exe
                              sc stop "SuperFetch"
                              2⤵
                                PID:2976
                              • C:\Windows\SYSTEM32\sc.exe
                                sc config "SuperFetch" start=disabled
                                2⤵
                                  PID:2672
                                • C:\Windows\SYSTEM32\fsutil.exe
                                  fsutil behavior set disablelastaccess 1
                                  2⤵
                                    PID:4024
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc stop "PcaSvc"
                                    2⤵
                                    • Launches sc.exe
                                    PID:4564
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc config "PcaSvc" start=disabled
                                    2⤵
                                    • Launches sc.exe
                                    PID:2240
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                    2⤵
                                    • Hide Artifacts: Ignore Process Interrupts
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3752
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                    2⤵
                                    • Hide Artifacts: Ignore Process Interrupts
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4040
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                    2⤵
                                    • Hide Artifacts: Ignore Process Interrupts
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:64
                                  • C:\Windows\SYSTEM32\fsutil.exe
                                    fsutil usn deletejournal /d C:
                                    2⤵
                                    • Deletes NTFS Change Journal
                                    PID:4504
                                  • C:\Windows\SYSTEM32\fsutil.exe
                                    fsutil usn deletejournal /d D:
                                    2⤵
                                    • Deletes NTFS Change Journal
                                    • Enumerates connected drives
                                    PID:4828
                                  • C:\Windows\SYSTEM32\fsutil.exe
                                    fsutil usn deletejournal /d F:
                                    2⤵
                                    • Deletes NTFS Change Journal
                                    • Enumerates connected drives
                                    PID:3228
                                  • C:\Windows\SYSTEM32\sc.exe
                                    sc stop "SysMain"
                                    2⤵
                                      PID:2280
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc config "SysMain" start=disabled
                                      2⤵
                                      • Launches sc.exe
                                      PID:2608
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc stop "SuperFetch"
                                      2⤵
                                      • Launches sc.exe
                                      PID:4164
                                    • C:\Windows\SYSTEM32\sc.exe
                                      sc config "SuperFetch" start=disabled
                                      2⤵
                                      • Launches sc.exe
                                      PID:1008
                                    • C:\Windows\SYSTEM32\fsutil.exe
                                      fsutil behavior set disablelastaccess 1
                                      2⤵
                                        PID:1488
                                      • C:\Windows\SYSTEM32\sc.exe
                                        sc stop "PcaSvc"
                                        2⤵
                                          PID:2304
                                        • C:\Windows\SYSTEM32\sc.exe
                                          sc config "PcaSvc" start=disabled
                                          2⤵
                                            PID:3772
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                            2⤵
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:916
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                            2⤵
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4220
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                            2⤵
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2328
                                          • C:\Windows\SYSTEM32\fsutil.exe
                                            fsutil usn deletejournal /d C:
                                            2⤵
                                              PID:2816
                                            • C:\Windows\SYSTEM32\fsutil.exe
                                              fsutil usn deletejournal /d D:
                                              2⤵
                                              • Deletes NTFS Change Journal
                                              • Enumerates connected drives
                                              PID:4044
                                            • C:\Windows\SYSTEM32\fsutil.exe
                                              fsutil usn deletejournal /d F:
                                              2⤵
                                              • Deletes NTFS Change Journal
                                              • Enumerates connected drives
                                              PID:1716
                                            • C:\Windows\SYSTEM32\sc.exe
                                              sc stop "SysMain"
                                              2⤵
                                                PID:3808
                                              • C:\Windows\SYSTEM32\sc.exe
                                                sc config "SysMain" start=disabled
                                                2⤵
                                                  PID:1736
                                                • C:\Windows\SYSTEM32\sc.exe
                                                  sc stop "SuperFetch"
                                                  2⤵
                                                    PID:4200
                                                  • C:\Windows\SYSTEM32\sc.exe
                                                    sc config "SuperFetch" start=disabled
                                                    2⤵
                                                      PID:1680
                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                      fsutil behavior set disablelastaccess 1
                                                      2⤵
                                                        PID:3228
                                                      • C:\Windows\SYSTEM32\sc.exe
                                                        sc stop "PcaSvc"
                                                        2⤵
                                                          PID:2280
                                                        • C:\Windows\SYSTEM32\sc.exe
                                                          sc config "PcaSvc" start=disabled
                                                          2⤵
                                                            PID:432
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                            2⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3924
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                            2⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3544
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                            2⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2976
                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                            fsutil usn deletejournal /d C:
                                                            2⤵
                                                            • Deletes NTFS Change Journal
                                                            PID:2592
                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                            fsutil usn deletejournal /d D:
                                                            2⤵
                                                            • Deletes NTFS Change Journal
                                                            • Enumerates connected drives
                                                            PID:1684
                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                            fsutil usn deletejournal /d F:
                                                            2⤵
                                                            • Deletes NTFS Change Journal
                                                            • Enumerates connected drives
                                                            PID:2792
                                                          • C:\Windows\SYSTEM32\sc.exe
                                                            sc stop "SysMain"
                                                            2⤵
                                                              PID:4404
                                                            • C:\Windows\SYSTEM32\sc.exe
                                                              sc config "SysMain" start=disabled
                                                              2⤵
                                                              • Launches sc.exe
                                                              PID:708
                                                            • C:\Windows\SYSTEM32\sc.exe
                                                              sc stop "SuperFetch"
                                                              2⤵
                                                                PID:744
                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                sc config "SuperFetch" start=disabled
                                                                2⤵
                                                                  PID:2328
                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                  fsutil behavior set disablelastaccess 1
                                                                  2⤵
                                                                    PID:2464
                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                    sc stop "PcaSvc"
                                                                    2⤵
                                                                      PID:220
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc config "PcaSvc" start=disabled
                                                                      2⤵
                                                                      • Launches sc.exe
                                                                      PID:2848
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                      2⤵
                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:2816
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                      2⤵
                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1560
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                      2⤵
                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1644
                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                      fsutil usn deletejournal /d C:
                                                                      2⤵
                                                                      • Deletes NTFS Change Journal
                                                                      PID:2724
                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                      fsutil usn deletejournal /d D:
                                                                      2⤵
                                                                      • Enumerates connected drives
                                                                      PID:4032
                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                      fsutil usn deletejournal /d F:
                                                                      2⤵
                                                                      • Deletes NTFS Change Journal
                                                                      • Enumerates connected drives
                                                                      PID:4860
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc stop "SysMain"
                                                                      2⤵
                                                                      • Launches sc.exe
                                                                      PID:5100
                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                      sc config "SysMain" start=disabled
                                                                      2⤵
                                                                        PID:4812
                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                        sc stop "SuperFetch"
                                                                        2⤵
                                                                          PID:1892
                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                          sc config "SuperFetch" start=disabled
                                                                          2⤵
                                                                            PID:4524
                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                            fsutil behavior set disablelastaccess 1
                                                                            2⤵
                                                                              PID:3744
                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                              sc stop "PcaSvc"
                                                                              2⤵
                                                                                PID:2240
                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                sc config "PcaSvc" start=disabled
                                                                                2⤵
                                                                                  PID:1916
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1824
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                  2⤵
                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:448
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                  2⤵
                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5048
                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                  fsutil usn deletejournal /d C:
                                                                                  2⤵
                                                                                  • Deletes NTFS Change Journal
                                                                                  PID:1752
                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                  fsutil usn deletejournal /d D:
                                                                                  2⤵
                                                                                  • Deletes NTFS Change Journal
                                                                                  • Enumerates connected drives
                                                                                  PID:4992
                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                  fsutil usn deletejournal /d F:
                                                                                  2⤵
                                                                                  • Enumerates connected drives
                                                                                  PID:4888
                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                  sc stop "SysMain"
                                                                                  2⤵
                                                                                    PID:2228
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc config "SysMain" start=disabled
                                                                                    2⤵
                                                                                    • Launches sc.exe
                                                                                    PID:4492
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc stop "SuperFetch"
                                                                                    2⤵
                                                                                    • Launches sc.exe
                                                                                    PID:1656
                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                    sc config "SuperFetch" start=disabled
                                                                                    2⤵
                                                                                    • Launches sc.exe
                                                                                    PID:2620
                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                    fsutil behavior set disablelastaccess 1
                                                                                    2⤵
                                                                                      PID:1232
                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                      sc stop "PcaSvc"
                                                                                      2⤵
                                                                                        PID:3696
                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                        sc config "PcaSvc" start=disabled
                                                                                        2⤵
                                                                                          PID:3000
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                          2⤵
                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:452
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                          2⤵
                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:2008
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                          2⤵
                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:2148
                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                          fsutil usn deletejournal /d C:
                                                                                          2⤵
                                                                                          • Deletes NTFS Change Journal
                                                                                          PID:4412
                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                          fsutil usn deletejournal /d D:
                                                                                          2⤵
                                                                                          • Deletes NTFS Change Journal
                                                                                          • Enumerates connected drives
                                                                                          PID:4388
                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                          fsutil usn deletejournal /d F:
                                                                                          2⤵
                                                                                          • Deletes NTFS Change Journal
                                                                                          • Enumerates connected drives
                                                                                          PID:1336
                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                          sc stop "SysMain"
                                                                                          2⤵
                                                                                            PID:4448
                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                            sc config "SysMain" start=disabled
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:3540
                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                            sc stop "SuperFetch"
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:2692
                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                            sc config "SuperFetch" start=disabled
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:4700
                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                            fsutil behavior set disablelastaccess 1
                                                                                            2⤵
                                                                                              PID:4820
                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                              sc stop "PcaSvc"
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:5072
                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                              sc config "PcaSvc" start=disabled
                                                                                              2⤵
                                                                                                PID:5020
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                2⤵
                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                PID:2244
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                2⤵
                                                                                                  PID:1756
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                  2⤵
                                                                                                    PID:3544
                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                    fsutil usn deletejournal /d C:
                                                                                                    2⤵
                                                                                                      PID:2548
                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                      fsutil usn deletejournal /d D:
                                                                                                      2⤵
                                                                                                      • Deletes NTFS Change Journal
                                                                                                      • Enumerates connected drives
                                                                                                      PID:2712
                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                      fsutil usn deletejournal /d F:
                                                                                                      2⤵
                                                                                                      • Deletes NTFS Change Journal
                                                                                                      • Enumerates connected drives
                                                                                                      PID:4744
                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                      sc stop "SysMain"
                                                                                                      2⤵
                                                                                                        PID:4424
                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                        sc config "SysMain" start=disabled
                                                                                                        2⤵
                                                                                                          PID:2328
                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                          sc stop "SuperFetch"
                                                                                                          2⤵
                                                                                                            PID:3704
                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                            sc config "SuperFetch" start=disabled
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:744
                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                            fsutil behavior set disablelastaccess 1
                                                                                                            2⤵
                                                                                                              PID:4748
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc stop "PcaSvc"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:4712
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc config "PcaSvc" start=disabled
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:864
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:1736
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:4528
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:1120
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d C:
                                                                                                              2⤵
                                                                                                              • Deletes NTFS Change Journal
                                                                                                              PID:3012
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d D:
                                                                                                              2⤵
                                                                                                              • Enumerates connected drives
                                                                                                              PID:3800
                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                              fsutil usn deletejournal /d F:
                                                                                                              2⤵
                                                                                                              • Deletes NTFS Change Journal
                                                                                                              • Enumerates connected drives
                                                                                                              PID:116
                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                              sc stop "SysMain"
                                                                                                              2⤵
                                                                                                                PID:216
                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                sc config "SysMain" start=disabled
                                                                                                                2⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:4408
                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                sc stop "SuperFetch"
                                                                                                                2⤵
                                                                                                                  PID:4892
                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                  2⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:452
                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                  fsutil behavior set disablelastaccess 1
                                                                                                                  2⤵
                                                                                                                    PID:4052
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    sc stop "PcaSvc"
                                                                                                                    2⤵
                                                                                                                      PID:3744
                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                      sc config "PcaSvc" start=disabled
                                                                                                                      2⤵
                                                                                                                        PID:2196
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                        2⤵
                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                        PID:3188
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                        2⤵
                                                                                                                          PID:708
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                          2⤵
                                                                                                                            PID:1100
                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                            2⤵
                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                            PID:3688
                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                            2⤵
                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                            • Enumerates connected drives
                                                                                                                            PID:1580
                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                            2⤵
                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                            • Enumerates connected drives
                                                                                                                            PID:2816
                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                            sc stop "SysMain"
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:1820
                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                            sc config "SysMain" start=disabled
                                                                                                                            2⤵
                                                                                                                              PID:2912
                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                              sc stop "SuperFetch"
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:232
                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                              2⤵
                                                                                                                                PID:2228
                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                2⤵
                                                                                                                                  PID:1596
                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                  2⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:3340
                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                  sc config "PcaSvc" start=disabled
                                                                                                                                  2⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:664
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                  2⤵
                                                                                                                                    PID:2724
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                    2⤵
                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                    PID:3412
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                    2⤵
                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                    PID:60
                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                    2⤵
                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                    PID:1552
                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                    2⤵
                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    PID:2556
                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                    2⤵
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    PID:3992
                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                    sc stop "SysMain"
                                                                                                                                    2⤵
                                                                                                                                      PID:2096
                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                      sc config "SysMain" start=disabled
                                                                                                                                      2⤵
                                                                                                                                        PID:2224
                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                        sc stop "SuperFetch"
                                                                                                                                        2⤵
                                                                                                                                          PID:4428
                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                          sc config "SuperFetch" start=disabled
                                                                                                                                          2⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          PID:4388
                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                          fsutil behavior set disablelastaccess 1
                                                                                                                                          2⤵
                                                                                                                                            PID:3324
                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                            sc stop "PcaSvc"
                                                                                                                                            2⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:864
                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                                                            2⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:1612
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                            2⤵
                                                                                                                                              PID:3688
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                              2⤵
                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                              PID:1820
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                              2⤵
                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                              PID:2616
                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                              fsutil usn deletejournal /d C:
                                                                                                                                              2⤵
                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                              PID:5056
                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                                              2⤵
                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                              • Enumerates connected drives
                                                                                                                                              PID:760
                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                                              2⤵
                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                              • Enumerates connected drives
                                                                                                                                              PID:4344
                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                              sc stop "SysMain"
                                                                                                                                              2⤵
                                                                                                                                                PID:3112
                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                                2⤵
                                                                                                                                                  PID:4544
                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                  sc stop "SuperFetch"
                                                                                                                                                  2⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:440
                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                                  2⤵
                                                                                                                                                    PID:936
                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                    fsutil behavior set disablelastaccess 1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4184
                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                      sc stop "PcaSvc"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1164
                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                        sc config "PcaSvc" start=disabled
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4220
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                          2⤵
                                                                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                          PID:2612
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4404
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                            2⤵
                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                            PID:3984
                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                                                            2⤵
                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                            PID:4720
                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                                                            2⤵
                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            PID:2692
                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                                                            2⤵
                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                            PID:1720
                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                            sc stop "SysMain"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1580
                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                              sc config "SysMain" start=disabled
                                                                                                                                                              2⤵
                                                                                                                                                              • Launches sc.exe
                                                                                                                                                              PID:1172
                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:264
                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                sc config "SuperFetch" start=disabled
                                                                                                                                                                2⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:636
                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1820
                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2988
                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                    PID:3456
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                    PID:4312
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                    PID:4800
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                    PID:440
                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                    PID:3724
                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    PID:4416
                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    PID:4220
                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                    PID:3712
                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                    sc config "SysMain" start=disabled
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2556
                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                      sc stop "SuperFetch"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4732
                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                        sc config "SuperFetch" start=disabled
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2448
                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                          fsutil behavior set disablelastaccess 1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3128
                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                            sc stop "PcaSvc"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4804
                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                              sc config "PcaSvc" start=disabled
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1076
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                PID:708
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                PID:4740
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1580
                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                  fsutil usn deletejournal /d C:
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                  PID:4368
                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                  fsutil usn deletejournal /d D:
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                  PID:2732
                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                  fsutil usn deletejournal /d F:
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Deletes NTFS Change Journal
                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                  PID:1820
                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                  sc stop "SysMain"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:1048
                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                  sc config "SysMain" start=disabled
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1152
                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                    sc stop "SuperFetch"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:664
                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                      sc config "SuperFetch" start=disabled
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3520
                                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                        fsutil behavior set disablelastaccess 1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5104
                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                          sc stop "PcaSvc"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3800
                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3936
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                              PID:4588
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                              PID:4052
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                              PID:1780
                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                              fsutil usn deletejournal /d C:
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                              PID:3392
                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                              PID:3128
                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                              PID:3992
                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                              sc stop "SysMain"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:2116
                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                              sc config "SysMain" start=disabled
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:768
                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:1920
                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2464
                                                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2928
                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                    PID:3664
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                    PID:3220
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                    PID:3696
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                    PID:3156
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                    sc config "SysMain" start=disabled
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5068
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                      sc stop "SuperFetch"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                      PID:2940
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                      sc config "SuperFetch" start=disabled
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                        fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                          sc stop "PcaSvc"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            PID:2608
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            PID:428
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                            sc stop "SysMain"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2912
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                              sc config "SysMain" start=disabled
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:4528
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                sc stop "SuperFetch"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                  PID:232
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                  fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3340
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                    sc stop "PcaSvc"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                    PID:4680
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                    PID:372
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                      fsutil usn deletejournal /d D:
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                      fsutil usn deletejournal /d F:
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Deletes NTFS Change Journal
                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                      sc stop "SysMain"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5040
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                        sc config "SysMain" start=disabled
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2848
                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                          sc stop "SuperFetch"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                            sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                              fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3324
                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                sc stop "PcaSvc"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                  sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                  PID:3808
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                    PID:228
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                    PID:3532
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                    sc config "SysMain" start=disabled
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                    PID:512
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                    sc stop "SuperFetch"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                      sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:760
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                        fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                          sc stop "PcaSvc"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                          PID:2496
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                          sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                            PID:736
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                            fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2848
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                              sc stop "SysMain"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4476
                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                  sc stop "SuperFetch"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2116
                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                    sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:404
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                      fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4116
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                        sc stop "PcaSvc"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                        sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                        PID:5088
                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                        fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                          fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                          PID:1756
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                          fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                          PID:2956
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                          sc stop "SysMain"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                            sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                              PID:5068
                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                  PID:1512
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                  sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                    fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                    fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                    fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                    sc stop "SysMain"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Launches sc.exe
                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                    sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                      sc stop "SuperFetch"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                        sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Launches sc.exe
                                                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                        fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:2280
                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                          sc stop "PcaSvc"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                            sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                            PID:3296
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                              fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                              fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                              fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                              PID:2200
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                              sc stop "SysMain"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1372
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                sc stop "SuperFetch"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:4052
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                  sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                    fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3668
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                      sc stop "PcaSvc"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                      sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                      PID:4404
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:404
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                          powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                          fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                          fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                          PID:1320
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                          fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                          sc stop "SysMain"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:3292
                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                            sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                              PID:812
                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                              sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                                fsutil behavior set disablelastaccess 1
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                  sc stop "PcaSvc"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                    sc config "PcaSvc" start=disabled
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1388
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:4408
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                                                                                                                                                                                                        PID:2336
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1184
                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                                          fsutil usn deletejournal /d C:
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2284
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                                            fsutil usn deletejournal /d D:
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\fsutil.exe
                                                                                                                                                                                                                                                                                                            fsutil usn deletejournal /d F:
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Deletes NTFS Change Journal
                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                            PID:4036
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                            sc stop "SysMain"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Launches sc.exe
                                                                                                                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                            sc config "SysMain" start=disabled
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3056
                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                              sc stop "SuperFetch"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:4676
                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\sc.exe
                                                                                                                                                                                                                                                                                                                sc config "SuperFetch" start=disabled
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                PID:4052
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -s w32time
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                • Boot or Logon Autostart Execution: Time Providers
                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                PID:3788

                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                                              PowerShell

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1059.001

                                                                                                                                                                                                                                                                                                              System Services

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1569

                                                                                                                                                                                                                                                                                                              Service Execution

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1569.002

                                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                              Time Providers

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1547.003

                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                              Server Software Component

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1505

                                                                                                                                                                                                                                                                                                              Terminal Services DLL

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1505.005

                                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                                              Time Providers

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1547.003

                                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                                                              Ignore Process Interrupts

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1564.011

                                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                                              System Time Discovery

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1124

                                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                                              Data Destruction

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1485

                                                                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                                                                              Service Stop

                                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                                              T1489

                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                64B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                9d737602ce1294db9496f81f7d1b9b70

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c0ce66d5335f1d614f640d220791503a2ca0effb

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                5bb96b5d8122947006a759fc4a5e31f34f5d34360cb55448b85cd8f7a3346be8

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                f4af041dc8a8ebc7bbb1b70ea0e19802d78456dae46f2ffba3dc3be6011a993acca001b9701f1a3e3e3b480ed3b3f8d9589e0f1da2b819555e60d8196b119f6c

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                64B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                446dd1cf97eaba21cf14d03aebc79f27

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                88be3bc8a7f90e3953298c0fdbec4d72

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                f4969784ad421cc80ef45608727aacd0f6bf2e4b

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                64B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                894afb4ff3cd7ee1f69400e936f8fc9d

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                aa0eb6ac58f8997940c1aa2e6f6c42d7c3837e51

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                20948b37924c58362ffc5d1472667b53c6d7fc865ad541c901cebf41d04a03c9

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                449494468d267f9689a277ce858dac7dfda04ceb568f60170645582fd631901a9ef780da8e420cba8a297edc11cd63a874e3429b95cf90e7261d2b9ab8850e98

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                64B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                35ed7b59fa28d08bb3b1816249204936

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                80cde2110c452e61bd64d6ae6bd6ab0c6e1f2d8d

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                49af4fe7f3f7a5e944bb74684c92c50c7424309ef148c97de885c1ad86ac08e1

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                cf787a4b9e049ec69002e326f42441ae3e9d271684b7f370c1edb1f17764d0e04134ff36675a0e60a7815869ddaf3375230a204e37fdd83a270b9595564fb64d

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                1020B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                f7008ed1313695169be572150801235c

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                c14a9659b8c619060ccd826002cb31ef6da24b69

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                e255e081f9ad6eb39ec2912a50720570563621bf6ecdcd6036ec94c6a4b30751

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                027df89bf352f08b56df82d8cb00e1699b4d1f3e5799047beb967d189a414a98257eab11b8b96f445ff0e67e9a87d21cc926a425bac6996a29abf043f5cc8aa0

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jreacsja.kry.ps1
                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                              • memory/868-158-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-5-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-880-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-18-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-819-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-758-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-1-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-4-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-3-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-89-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-694-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-2-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-426-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-225-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-292-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-359-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-0-0x00007FFCF26D0000-0x00007FFCF26D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-493-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-560-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/868-627-0x0000000140000000-0x000000014325E000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                50.4MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2600-7-0x00007FFCF2630000-0x00007FFCF2825000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2600-6-0x00007FFCF2630000-0x00007FFCF2825000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2600-13-0x000001FE4B3B0000-0x000001FE4B3D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                              • memory/2600-21-0x00007FFCF2630000-0x00007FFCF2825000-memory.dmp

                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                2.0MB

                                                                                                                                                                                                                                                                                                                Download