Overview

overview

8

Static

static

1

privacy-script.bat

windows10-2004-x64

8

privacy-script.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    23s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    privacy-script.bat
  • Size 850KB
  • Sample260703-pphbrsd16k
  • SHA256 2fbb4b8dc1aac8aa951c98fe274a745edcf112d0ddcac0f42736a89a4228fc94
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploit

Malware Config

Signatures

  • Drops file in Drivers directory 12 IoCs
  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Using powershell.exe command.

    execution
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 30 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry key 1 TTPs 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\privacy-script.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Windows\system32\where.exe
      where PowerShell
      2⤵
        PID:1968
      • C:\Windows\system32\fltMC.exe
        fltmc
        2⤵
          PID:4472
        • C:\Windows\system32\net.exe
          net user defaultuser0 /delete
          2⤵
          • Indicator Removal: Network Share Connection Removal
          • Suspicious use of WriteProcessMemory
          PID:5548
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 user defaultuser0 /delete
            3⤵
            • Indicator Removal: Network Share Connection Removal
            PID:3048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration'; $data = '0'; reg add 'HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration' /v 'DisableResetbase' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3152
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration /v DisableResetbase /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:4288
        • C:\Windows\system32\Dism.exe
          dism /online /Remove-DefaultAppAssociations
          2⤵
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:5180
          • C:\Windows\System32\Dism\dismhost.exe
            C:\Windows\System32\Dism\dismhost.exe {C8B92DA6-32C9-4AFF-8D0A-2CE2C057BFFC}
            3⤵
            • Drops file in Windows directory
            PID:4652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'DPS'; Write-Host """Stopping service: `"""$serviceName`"""."""; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if (!$service) { Write-Host """Skipping, service `"""$serviceName`""" could not be not found, no need to stop it."""; exit 0; }; if ($service.Status -ne [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """Skipping, `"""$serviceName`""" is not running, no need to stop."""; exit 0; }; Write-Host """`"""$serviceName`""" is running, stopping it."""; try { $service | Stop-Service -Force -ErrorAction Stop; $service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Stopped); } catch { throw """Failed to stop the service `"""$serviceName`""": $_"""; }; Write-Host """Successfully stopped the service: `"""$serviceName`"""."""; function Get-StateFilePath($BaseName, $Suffix) { $escapedBaseName = $BaseName.Split([IO.Path]::GetInvalidFileNameChars()) -Join '_'; $uniqueFilename = $escapedBaseName, $Suffix -Join '-'; $path = [IO.Path]::Combine( $env:APPDATA, 'privacy.sexy', 'state', $uniqueFilename ); return $path; }; function Get-UniqueStateFilePath($BaseName) { $suffix = New-Guid; $path = Get-StateFilePath -BaseName $BaseName -Suffix $suffix; if (Test-Path -Path $path) { Write-Verbose """Path collision detected at: '$path'. Generating new path..."""; return Get-UniqueStateFilePath $serviceName; }; return $path; }; function New-EmptyFile($Path) { $parentDirectory = [System.IO.Path]::GetDirectoryName($Path); if (-not (Test-Path $parentDirectory -PathType Container)) { try { New-Item -ItemType Directory -Path $parentDirectory -Force -ErrorAction Stop | Out-Null; } catch { Write-Warning """Failed to create parent directory of file `"""$parentDirectory`""": $_"""; }; }; try { New-Item -ItemType File -Path $Path -Force -ErrorAction Stop | Out-Null; return $true; } catch { Write-Warning """Failed to create file `"""$Path`""": $_"""; return $false; }; }; $path = Get-UniqueStateFilePath $serviceName; if (New-EmptyFile $path) { Write-Host 'Service will restart automatically.'; } else { Write-Warning 'Manual restart required - please restart your computer.'; }"
          2⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """C:\Windows\System32\sru\SRUDB.dat"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; <# Not using `Get-Acl`/`Set-Acl` to avoid adjusting token privileges #>; $parentDirectory = [System.IO.Path]::GetDirectoryName($expandedPath); $fileName = [System.IO.Path]::GetFileName($expandedPath); if ($parentDirectory -like '*[*?]*') { throw """Unable to grant permissions to glob path parent directory: `"""$parentDirectory`""", wildcards in parent directory are not supported by ``takeown`` and ``icacls``."""; }; if (($fileName -ne '*') -and ($fileName -like '*[*?]*')) { throw """Unable to grant permissions to glob path file name: `"""$fileName`""", wildcards in file name is not supported by ``takeown`` and ``icacls``."""; }; Write-Host """Taking ownership of `"""$expandedPath`"""."""; $cmdPath = $expandedPath; if ($cmdPath.EndsWith('\')) { $cmdPath += '\' <# Escape trailing backslash for correct handling in batch commands #>; }; $takeOwnershipCommand = """takeown /f `"""$cmdPath`""" /a""" <# `icacls /setowner` does not succeed, so use `takeown` instead. #>; if (-not (Test-Path -Path """$expandedPath""" -PathType Leaf)) { $localizedYes = 'Y' <# Default 'Yes' flag (fallback) #>; try { $choiceOutput = cmd /c """choice <nul 2>nul"""; if ($choiceOutput -and $choiceOutput.Length -ge 2) { $localizedYes = $choiceOutput[1]; } else { Write-Warning """Failed to determine localized 'Yes' character. Output: `"""$choiceOutput`""""""; }; } catch { Write-Warning """Failed to determine localized 'Yes' character. Error: $_"""; }; $takeOwnershipCommand += """ /r /d $localizedYes"""; }; $takeOwnershipOutput = cmd /c """$takeOwnershipCommand 2>&1""" <# `stderr` message is misleading, e.g. """ERROR: The system cannot find the file specified.""" is not an error. #>; if ($LASTEXITCODE -eq 0) { Write-Host """Successfully took ownership of `"""$expandedPath`""" (using ``$takeOwnershipCommand``)."""; } else { Write-Host """Did not take ownership of `"""$expandedPath`""" using ``$takeOwnershipCommand``, status code: $LASTEXITCODE, message: $takeOwnershipOutput."""; <# Do not write as error or warning, because this can be due to missing path, it's handled in next command. #>; <# `takeown` exits with status code `1`, making it hard to handle missing path here. #>; }; Write-Host """Granting permissions for `"""$expandedPath`"""."""; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminAccountName = $adminAccount.Value; $grantPermissionsCommand = """icacls `"""$cmdPath`""" /grant `"""$($adminAccountName):F`""" /t"""; $icaclsOutput = cmd /c """$grantPermissionsCommand"""; if ($LASTEXITCODE -eq 3) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } elseif ($LASTEXITCODE -ne 0) { Write-Host """Take ownership message:`n$takeOwnershipOutput"""; Write-Host """Grant permissions:`n$icaclsOutput"""; Write-Warning """Failed to assign permissions for `"""$expandedPath`""" using ``$grantPermissionsCommand``, status code: $LASTEXITCODE."""; } else { $fileStats = $icaclsOutput | ForEach-Object { $_ -match '\d+' | Out-Null; $matches[0] } | Where-Object { $_ -ne $null } | ForEach-Object { [int]$_ }; if ($fileStats.Count -gt 0 -and ($fileStats | ForEach-Object { $_ -eq 0 } | Where-Object { $_ -eq $false }).Count -eq 0) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } else { Write-Host """Successfully granted permissions for `"""$expandedPath`""" (using ``$grantPermissionsCommand``)."""; }; }; $deletedCount = 0; $failedCount = 0; $skippedCount = 0; $foundAbsolutePaths = @(); try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (Test-Path -Path $path -PathType Container) { Write-Host """Skipping, the path is not a file but a folder: $($path)."""; $skippedCount++; continue; }; if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; if ($skippedCount -gt 0) { Write-Host """Skipped $($skippedCount) items."""; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6080
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "takeown /f "C:\Windows\System32\sru\SRUDB.dat" /a 2>&1"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4984
            • C:\Windows\system32\takeown.exe
              takeown /f "C:\Windows\System32\sru\SRUDB.dat" /a
              4⤵
              • Possible privilege escalation attempt
              • Modifies file permissions
              PID:4804
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "icacls "C:\Windows\System32\sru\SRUDB.dat" /grant "BUILTIN\Administrators:F" /t"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1704
            • C:\Windows\system32\icacls.exe
              icacls "C:\Windows\System32\sru\SRUDB.dat" /grant "BUILTIN\Administrators:F" /t
              4⤵
              • Possible privilege escalation attempt
              • Modifies file permissions
              PID:3764
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'DPS'; function Get-StateFilePath($BaseName, $Suffix) { $escapedBaseName = $BaseName.Split([IO.Path]::GetInvalidFileNameChars()) -Join '_'; $uniqueFilename = $escapedBaseName, $Suffix -Join '-'; $path = [IO.Path]::Combine( $env:APPDATA, 'privacy.sexy', 'state', $uniqueFilename ); return $path; }; $fileGlob = Get-StateFilePath -BaseName $serviceName -Suffix '*'; $files = Get-ChildItem -Path """$fileGlob"""; if ($files.Count -gt 0) { $firstFilePath = $files[0].FullName; try { Remove-Item -Path $firstFilePath -Force -ErrorAction Stop; Write-Host 'The service is expected to be started.'; } catch { Write-Warning """Failed to delete the service state file `"""$firstFilePath`""": $_"""; }; }; if ($files.Count -ne 1) { <# Not the last file requiring restart #>; Write-Host 'Skipping starting the service: It was not running before.'; exit 0; }; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if (!$service) { throw """Failed to start service `"""$serviceName`""": Service not found."""; }; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """Skipping, `"""$serviceName`""" is already running, no need to start."""; exit 0; }; Write-Host """`"""$serviceName`""" is not running, starting it."""; try { $service | Start-Service -ErrorAction Stop; Write-Host """Successfully started the service: `"""$serviceName`"""."""; } catch { Write-Warning """Failed to start the service: `"""$serviceName`"""."""; exit 1; }"
          2⤵
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1012
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy'; $data = '0'; reg add 'HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' /v 'HasAccepted' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1100
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy /v HasAccepted /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:3532
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Personalization\Settings'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Personalization\Settings' /v 'AcceptedPrivacyPolicy' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Personalization\Settings /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:3556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Siuf\Rules'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Siuf\Rules' /v 'NumberOfSIUFInPeriod' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Siuf\Rules /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:4704
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$keyName = 'HKCU\SOFTWARE\Microsoft\Siuf\Rules'; $valueName = 'PeriodInNanoSeconds'; $hive = $keyName.Split('\')[0]; $path = """$($hive):$($keyName.Substring($hive.Length))"""; Write-Host """Removing the registry value '$valueName' from '$path'."""; if (-Not (Test-Path -LiteralPath $path)) { Write-Host 'Skipping, no action needed, registry key does not exist.'; Exit 0; }; $existingValueNames = (Get-ItemProperty -LiteralPath $path).PSObject.Properties.Name; if (-Not ($existingValueNames -Contains $valueName)) { Write-Host 'Skipping, no action needed, registry value does not exist.'; Exit 0; }; try { if ($valueName -ieq '(default)') { Write-Host 'Removing the default value.'; $(Get-Item -LiteralPath $path).OpenSubKey('', $true).DeleteValue(''); } else { Remove-ItemProperty -LiteralPath $path -Name $valueName -Force -ErrorAction Stop; }; Write-Host 'Successfully removed the registry value.'; } catch { Write-Error """Failed to remove the registry value: $($_.Exception.Message)"""; }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection'; $data = '1'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' /v 'DoNotShowFeedbackNotifications' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:264
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:2224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection' /v 'DoNotShowFeedbackNotifications' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5076
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:1168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'RestrictImplicitInkCollection' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2512
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:5708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'RestrictImplicitTextCollection' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports' /v 'PreventHandwritingErrorReports' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports /v PreventHandwritingErrorReports /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:5080
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC' /v 'PreventHandwritingDataSharing' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5736
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:5424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'AllowInputPersonalization' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v AllowInputPersonalization /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:4508
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore' /v 'HarvestContacts' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6120
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore /v HarvestContacts /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:1128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' /v 'DisableSensors' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors /v DisableSensors /t REG_DWORD /d 1 /f
            3⤵
            • Modifies registry key
            PID:5652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting'; $data = '0'; reg add 'HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting' /v 'value' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting /v value /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:3140
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots'; $data = '0'; reg add 'HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots' /v 'Enabled' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:548
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots /v Enabled /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:4668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config'; $data = '0'; reg add 'HKLM\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config' /v 'AutoConnectAllowedOEM' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config /v AutoConnectAllowedOEM /t REG_DWORD /d 0 /f
            3⤵
            • Modifies registry key
            PID:1160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Control Panel\International\User Profile'; $data = '1'; reg add 'HKCU\Control Panel\International\User Profile' /v 'HttpAcceptLanguageOptOut' /t 'REG_DWORD' /d """$data""" /f"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f
            3⤵
              PID:960
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps' /v 'AllowUntriggeredNetworkTrafficOnSettingsPage' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5796
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:4720
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps' /v 'AutoDownloadAndUpdateMapData' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:5020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\System\GameConfigStore'; $data = '0'; reg add 'HKCU\System\GameConfigStore' /v 'GameDVR_Enabled' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKCU\System\GameConfigStore /v GameDVR_Enabled /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:1332
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR' /v 'AllowGameDVR' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5908
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:2236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\WMDRM'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\WMDRM' /v 'DisableOnline' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\WMDRM /v DisableOnline /t REG_DWORD /d 1 /f
              3⤵
              • Modifies registry key
              PID:4264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Input\TIPC'; $data = '0'; reg add 'HKLM\SOFTWARE\Microsoft\Input\TIPC' /v 'Enabled' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3900
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Input\TIPC /v Enabled /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:5824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Input\TIPC'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Input\TIPC' /v 'Enabled' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1512
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Input\TIPC /v Enabled /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:5388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v 'EnableActivityFeed' /t 'REG_DWORD' /d """$data""" /f"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3232
            • C:\Windows\system32\reg.exe
              "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableActivityFeed /t REG_DWORD /d 0 /f
              3⤵
              • Modifies registry key
              PID:3556
          • C:\Windows\system32\setx.exe
            setx DOTNET_CLI_TELEMETRY_OPTOUT 1
            2⤵
              PID:5224
            • C:\Windows\system32\setx.exe
              setx POWERSHELL_TELEMETRY_OPTOUT 1
              2⤵
                PID:2912
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'Razer Game Scanner Service'; Write-Host """Disabling service: `"""$serviceName`"""."""; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if(!$service) { Write-Host """Service `"""$serviceName`""" could not be not found, no need to disable it."""; Exit 0; }; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """`"""$serviceName`""" is running, stopping it."""; try { Stop-Service -Name """$serviceName""" -Force -ErrorAction Stop; Write-Host """Stopped `"""$serviceName`""" successfully."""; } catch { Write-Warning """Could not stop `"""$serviceName`""", it will be stopped after reboot: $_"""; }; } else { Write-Host """`"""$serviceName`""" is not running, no need to stop."""; }; <# -- 3. Skip if already disabled #>; $startupType = $service.StartType <# Does not work before .NET 4.6.1 #>; if (!$startupType) { $startupType = (Get-WmiObject -Query """Select StartMode From Win32_Service Where Name='$serviceName'""" -ErrorAction Ignore).StartMode; if(!$startupType) { $startupType = (Get-WmiObject -Class Win32_Service -Property StartMode -Filter """Name='$serviceName'""" -ErrorAction Ignore).StartMode; }; }; if ($startupType -eq 'Disabled') { Write-Host """$serviceName is already disabled, no further action is needed"""; Exit 0; }; <# -- 4. Disable service #>; try { Set-Service -Name """$serviceName""" -StartupType Disabled -Confirm:$false -ErrorAction Stop; Write-Host """Disabled `"""$serviceName`""" successfully."""; } catch { Write-Error """Could not disable `"""$serviceName`""": $_"""; }"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Hide Artifacts: Ignore Process Interrupts
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2804
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'LogiRegistryService'; Write-Host """Disabling service: `"""$serviceName`"""."""; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if(!$service) { Write-Host """Service `"""$serviceName`""" could not be not found, no need to disable it."""; Exit 0; }; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """`"""$serviceName`""" is running, stopping it."""; try { Stop-Service -Name """$serviceName""" -Force -ErrorAction Stop; Write-Host """Stopped `"""$serviceName`""" successfully."""; } catch { Write-Warning """Could not stop `"""$serviceName`""", it will be stopped after reboot: $_"""; }; } else { Write-Host """`"""$serviceName`""" is not running, no need to stop."""; }; <# -- 3. Skip if already disabled #>; $startupType = $service.StartType <# Does not work before .NET 4.6.1 #>; if (!$startupType) { $startupType = (Get-WmiObject -Query """Select StartMode From Win32_Service Where Name='$serviceName'""" -ErrorAction Ignore).StartMode; if(!$startupType) { $startupType = (Get-WmiObject -Class Win32_Service -Property StartMode -Filter """Name='$serviceName'""" -ErrorAction Ignore).StartMode; }; }; if ($startupType -eq 'Disabled') { Write-Host """$serviceName is already disabled, no further action is needed"""; Exit 0; }; <# -- 4. Disable service #>; try { Set-Service -Name """$serviceName""" -StartupType Disabled -Confirm:$false -ErrorAction Stop; Write-Host """Disabled `"""$serviceName`""" successfully."""; } catch { Write-Error """Could not disable `"""$serviceName`""": $_"""; }"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Hide Artifacts: Ignore Process Interrupts
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2076
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; $data = '255'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'NoDriveTypeAutoRun' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:520
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
                  3⤵
                  • Modifies registry key
                  PID:2316
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'NoAutorun' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2716
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoAutorun /t REG_DWORD /d 1 /f
                  3⤵
                  • Modifies registry key
                  PID:4744
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v 'NoAutoplayfornonVolume' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4552
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v NoAutoplayfornonVolume /t REG_DWORD /d 1 /f
                  3⤵
                  • Modifies registry key
                  PID:4376
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v 'NoLockScreenCamera' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2168
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f
                  3⤵
                  • Modifies registry key
                  PID:4504
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa'; $data = '1'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' /v 'NoLMHash' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4872
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NoLMHash /t REG_DWORD /d 1 /f
                  3⤵
                  • Modifies registry key
                  PID:1164
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer' /v 'AlwaysInstallElevated' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:1952
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
                  3⤵
                  • Modifies registry key
                  PID:3964
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel' /v 'DisableExceptionChainValidation' /t 'REG_DWORD' /d """$data""" /f"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4420
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
                  3⤵
                    PID:4940
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$featureName = 'MicrosoftWindowsPowerShellV2'; $feature = Get-WindowsOptionalFeature -FeatureName """$featureName""" -Online -ErrorAction Stop; if (-Not $feature) { Write-Output """Skipping: The feature `"""$featureName`""" is not found. No action required."""; Exit 0; }; if ($feature.State -eq [Microsoft.Dism.Commands.FeatureState]::Disabled) { Write-Output """Skipping: The feature `"""$featureName`""" is already disabled. No action required."""; Exit 0; }; try { Write-Host """Disabling feature: `"""$featureName`"""."""; Disable-WindowsOptionalFeature -FeatureName """$featureName""" -Online -NoRestart -LogLevel ([Microsoft.Dism.Commands.LogLevel]::Errors) -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null; } catch { Write-Error """Failed to disable the feature `"""$featureName`""": $($_.Exception.Message)"""; Exit 1; }; Write-Output """Successfully disabled the feature `"""$featureName`"""."""; Exit 0"
                  2⤵
                  • Drops file in Windows directory
                  • Hide Artifacts: Ignore Process Interrupts
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5060
                  • C:\Windows\System32\Dism\dismhost.exe
                    C:\Windows\System32\Dism\dismhost.exe {B0E4E6D8-3929-4674-BCA0-4F9C04BD6EBB}
                    3⤵
                    • Drops file in Windows directory
                    PID:3124
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$featureName = 'MicrosoftWindowsPowerShellV2Root'; $feature = Get-WindowsOptionalFeature -FeatureName """$featureName""" -Online -ErrorAction Stop; if (-Not $feature) { Write-Output """Skipping: The feature `"""$featureName`""" is not found. No action required."""; Exit 0; }; if ($feature.State -eq [Microsoft.Dism.Commands.FeatureState]::Disabled) { Write-Output """Skipping: The feature `"""$featureName`""" is already disabled. No action required."""; Exit 0; }; try { Write-Host """Disabling feature: `"""$featureName`"""."""; Disable-WindowsOptionalFeature -FeatureName """$featureName""" -Online -NoRestart -LogLevel ([Microsoft.Dism.Commands.LogLevel]::Errors) -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null; } catch { Write-Error """Failed to disable the feature `"""$featureName`""": $($_.Exception.Message)"""; Exit 1; }; Write-Output """Successfully disabled the feature `"""$featureName`"""."""; Exit 0"
                  2⤵
                  • Drops file in Windows directory
                  • Hide Artifacts: Ignore Process Interrupts
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5728
                  • C:\Windows\System32\Dism\dismhost.exe
                    C:\Windows\System32\Dism\dismhost.exe {FDE64AF6-21A7-4127-A837-DBCDD6A361A0}
                    3⤵
                    • Drops file in Windows directory
                    PID:2032
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\Software\Policies\Microsoft\Windows\WCN\UI'; $data = '1'; reg add 'HKLM\Software\Policies\Microsoft\Windows\WCN\UI' /v 'DisableWcnUi' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3792
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\WCN\UI /v DisableWcnUi /t REG_DWORD /d 1 /f
                    3⤵
                    • Modifies registry key
                    PID:4476
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableFlashConfigRegistrar' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5948
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableFlashConfigRegistrar /t REG_DWORD /d 0 /f
                    3⤵
                    • Modifies registry key
                    PID:776
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableInBand802DOT11Registrar' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5892
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableInBand802DOT11Registrar /t REG_DWORD /d 0 /f
                    3⤵
                    • Modifies registry key
                    PID:1508
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableUPnPRegistrar' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4888
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableUPnPRegistrar /t REG_DWORD /d 0 /f
                    3⤵
                    • Modifies registry key
                    PID:3888
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableWPDRegistrar' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5008
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableWPDRegistrar /t REG_DWORD /d 0 /f
                    3⤵
                    • Modifies registry key
                    PID:4852
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'EnableRegistrars' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4840
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v EnableRegistrars /t REG_DWORD /d 0 /f
                    3⤵
                    • Modifies registry key
                    PID:5100
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='oca.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3844
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='oca.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5992
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='kmwatsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4760
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='watson.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5204
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='umwatsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4544
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='ceuswatcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4764
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='ceuswatcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5856
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eaus2watcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6068
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eaus2watcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3264
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='weus2watcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1748
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='weus2watcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2116
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='co4.telecommand.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Drops file in Drivers directory
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4692
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='cs11.wpc.v0cdn.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1736
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='cs1137.wpc.gammacdn.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5460
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='modern.watson.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:4696
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='functional.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5028
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='browser.events.data.msn.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:4792
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='self.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:1232
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3936
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:6112
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='us-v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:1280
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eu-v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5596
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10.vortex-win.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5904
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='vortex-win.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:2260
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='telecommand.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:6088
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='www.telecommandsvc.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3188
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='umwatson.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5876
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='watsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:6004
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eu-watsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:5756
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='config.edge.skype.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Network Configuration Discovery: Internet Connection Discovery
                  PID:3416
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v 'DisableLockScreenAppNotifications' /t 'REG_DWORD' /d """$data""" /f"
                  2⤵
                    PID:2884
                    • C:\Windows\system32\reg.exe
                      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLockScreenAppNotifications /t REG_DWORD /d 1 /f
                      3⤵
                      • Modifies registry key
                      PID:2876
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications'; $data = '1'; reg add 'HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications' /v 'NoTileApplicationNotification' /t 'REG_DWORD' /d """$data""" /f"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4776
                    • C:\Windows\system32\reg.exe
                      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f
                      3⤵
                      • Modifies registry key
                      PID:4488
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v 'NoUseStoreOpenWith' /t 'REG_DWORD' /d """$data""" /f"
                    2⤵
                      PID:4780
                      • C:\Windows\system32\reg.exe
                        "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v NoUseStoreOpenWith /t REG_DWORD /d 1 /f
                        3⤵
                        • Modifies registry key
                        PID:4260
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'DisableMFUTracking' /t 'REG_DWORD' /d """$data""" /f"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4920
                      • C:\Windows\system32\reg.exe
                        "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v DisableMFUTracking /t REG_DWORD /d 1 /f
                        3⤵
                        • Modifies registry key
                        PID:3124
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'DisableRecentApps' /t 'REG_DWORD' /d """$data""" /f"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1808
                      • C:\Windows\system32\reg.exe
                        "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v DisableRecentApps /t REG_DWORD /d 1 /f
                        3⤵
                        • Modifies registry key
                        PID:4244
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'TurnOffBackstack' /t 'REG_DWORD' /d """$data""" /f"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5176
                      • C:\Windows\system32\reg.exe
                        "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v TurnOffBackstack /t REG_DWORD /d 1 /f
                        3⤵
                        • Modifies registry key
                        PID:2456
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4664
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2432
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2364
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$keyPath='HKCU\Software\Adobe\MediaBrowser\MRU'; $registryHive = $keyPath.Split('\')[0]; $registryPath = """$($registryHive):$($keyPath.Substring($registryHive.Length))"""; Write-Host """Removing registry key at `"""$registryPath`"""."""; if (-not (Test-Path -LiteralPath $registryPath)) { Write-Host """Skipping, no action needed, registry key `"""$registryPath`""" does not exist."""; exit 0; }; try { Remove-Item -LiteralPath $registryPath -Force -ErrorAction Stop | Out-Null; Write-Host """Successfully removed the registry key at path `"""$registryPath`"""."""; } catch { Write-Error """Failed to remove the registry key at path `"""$registryPath`""": $($_.Exception.Message)"""; }"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4892
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3296
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1048
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Search Assistant\ACMru'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5400
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2992
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5152
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ConnectedSearch\History'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                      2⤵
                        PID:936
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:4948
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:400
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5284
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent Items'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                        2⤵
                          PID:1208
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4908
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\MediaPlayer\Player\RecentURLList'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2092
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Gabest\Media Player Classic\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:5424
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Direct3D\MostRecentApplication'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:3144
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:2276
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                          2⤵
                            PID:4152
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\.dotnet\TelemetryStorageService'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                            2⤵
                              PID:1564
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Windows\Temp'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                              2⤵
                                PID:5340
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Temp'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
                                2⤵
                                  PID:5436

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 bdfd0cfe865ad4c5394af677f98001d4c3dc3668ced2aa5ba28b59f9e38c9478
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 64B
                                    • SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 1bd917aeac4b1dfbdb09d6f58648e466790de457e16556abce46111b9f5d3057
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 45a34c0112bab5a4442d41801451813b8c4358808492c2d3e30d2e4182ede0d6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 64B
                                    • SHA256 7687942aa7b74df86b7b7cb99d4f30530c568eae05c9225a7e4a7f6344e68a4c
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 64B
                                    • SHA256 51ab3623210ccda882e6de52dae58a80c131350e428ebd73515155776d31bd10
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 1e2fb75a3dcc201ec6bc17e920678cc72d58772818584f29dcf9e22a690a6342
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 1d0773fee6487253ee25c0d9def690f84b2311dd85e84445e93123aa8fde9b6a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 3551398141ea2878d2f964f35088c8d6544b3115a9079ebb5a17757d44e5062a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 46a7b62f63a994730315f67564f547977c1e8c4dcdab3db51d4099c4742e74fa
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 a9ab47788bf8e2860b3593c6cd4a7024c13f9086a16c575bd49fc64109806082
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 64B
                                    • SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 64B
                                    • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 95bf34d339698a4bb28f3d149bf3bd4631d612be2a593d2b126dd3f596c2d062
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_gwqujfiw.5h3.ps1
                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwqujfiw.5h3.ps1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 287KB
                                    • SHA256 575074f05e7c1b61b3783afa29b7deabae3894df96b071f70892054fbab106ac
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 287KB
                                    • SHA256 32603eac52f80c84b97f661b0261a6d4356673843f9a1ddec8a9ca47797bea41
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 291KB
                                    • SHA256 5f8d8260966e766e4e799d724913b629bcc9540e7ff66cab061f2d71a4f8427a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 299KB
                                    • SHA256 15b94910f4468aecc224744b41a7a0e2a23e393316372b3b09b0cfa56b91ce74
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 304KB
                                    • SHA256 bb26d22179928ee78e20932947e3126591befbd68f700b7e5aacd4c80529d1c0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 315KB
                                    • SHA256 083966ff9c12b1aa5f881548b8cb44b14d77239c3c8db8da7f65b8bea077c6f3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 316KB
                                    • SHA256 ee3f982ae7fd6779ded6529200d7a8ca09bf48b6120a5eccb5c7e61f6024ea98
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    dism.log
                                    • Path C:\Windows\Logs\DISM\dism.log
                                    • Size 323KB
                                    • SHA256 81aecc1f9103bb0b09b0376f081e6e465e376622cc8ffe9c9b5518d86b9bc9c4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 1KB
                                    • SHA256 c1d10f4c2661d8bc74bdcf4f5d08c9869bc104fd40a62380cbcc5a776d0b7084
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 1KB
                                    • SHA256 28f1039b5c9ece313d15e92890d36bf63966467a1498180a830ebc5f5d362c76
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 1KB
                                    • SHA256 dde64b9b6df7e4956bca99ad55074b3b9decd2148c72552266a2cbbadb83f439
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 1KB
                                    • SHA256 cb02da22de1a615e3e72844641c6413b4f5f9f892c217a9f4ce7c2721489a8b1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 1KB
                                    • SHA256 7efc6a226416bbfd27843dfbcf753071f1faeac2bd880a34a623935c8505bada
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    hosts
                                    • Path C:\Windows\System32\drivers\etc\hosts
                                    • Size 4KB
                                    • SHA256 3c85b31896983bcdefa9ffa98b8cc2e863845115cca4b16850c0cf43df565fed
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/3152-9-0x00007FFE51380000-0x00007FFE51D24000-memory.dmp
                                    Download

                                    memory/3152-0-0x00007FFE5150F000-0x00007FFE51510000-memory.dmp
                                    Download

                                    memory/3152-8-0x00007FFE51380000-0x00007FFE51D24000-memory.dmp
                                    Download

                                    memory/3152-6-0x00007FFE51380000-0x00007FFE51D24000-memory.dmp
                                    Download

                                    memory/3152-5-0x00007FFE51380000-0x00007FFE51D24000-memory.dmp
                                    Download

                                    memory/3152-4-0x000002055A960000-0x000002055A982000-memory.dmp
                                    Download

                                    memory/3152-3-0x00007FFE51380000-0x00007FFE51D24000-memory.dmp
                                    Download

                                    memory/5060-175-0x000002337BA50000-0x000002337BA6E000-memory.dmp
                                    Download

                                    memory/5060-176-0x000002337BCC0000-0x000002337BD72000-memory.dmp
                                    Download

                                    memory/5060-177-0x000002337BA40000-0x000002337BA4A000-memory.dmp
                                    Download

                                    memory/5060-178-0x000002337BFD0000-0x000002337BFF8000-memory.dmp
                                    Download