f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f

Analysis

max time kernel
53s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
Size 37.9MB
Sample260708-tx5t9act7l
SHA256 f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f
MD5 f51e9bc49f162fcd532b845ff3ec9de6
SHA1 6742fcf850ae6ab0a01c664a3691744be0efe2bd
SHA512 003c47be36729219e3039038e97cc031bf7c2f0a6db02860d941e40e9de256ebc2ed89ee6b73f8a29d26e8cf7d051a0616bb29a043fbfd9278a17f27a269c270
SSDEEP 393216:HuzYCDUnIvxMKOgN9l5qx40Y1MSQsq6rOhP4IXF7gwE1H:OcCiK3HMSk6rOM1H
TLSH
T1C9977D26A6D940EDC497807D0D9582A2BF337C4647309AEBD08975726E33AF4EB3D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c63b-28.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c63b-28.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c63b-28.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1628	powershell.exe
4560	powershell.exe
4120	powershell.exe
2368	powershell.exe
3824	powershell.exe
4376	powershell.exe
3696	powershell.exe
6384	powershell.exe
3076	powershell.exe
4220	powershell.exe
3316	powershell.exe
1412	powershell.exe
5992	powershell.exe
3032	powershell.exe
6756	powershell.exe
6648	powershell.exe
6248	powershell.exe
468	powershell.exe
2748	powershell.exe
2036	powershell.exe
3664	powershell.exe
5512	powershell.exe
1496	powershell.exe
916	powershell.exe
2408	powershell.exe
6744	powershell.exe
4176	powershell.exe
2764	powershell.exe
3028	powershell.exe
6700	powershell.exe
2952	powershell.exe
6080	powershell.exe
4772	powershell.exe
4788	powershell.exe
5880	powershell.exe
1320	powershell.exe
1388	powershell.exe
4944	powershell.exe
3712	powershell.exe
3684	powershell.exe
3436	powershell.exe
1196	powershell.exe
2396	powershell.exe
5468	powershell.exe
6980	powershell.exe
2512	powershell.exe
1636	powershell.exe
1292	powershell.exe
2584	powershell.exe
1692	powershell.exe
6992	powershell.exe
5124	powershell.exe
2928	powershell.exe
6956	powershell.exe
52	powershell.exe
1972	powershell.exe
7028	powershell.exe
5504	powershell.exe
3640	powershell.exe
5412	powershell.exe
1492	powershell.exe
6396	powershell.exe
4440	powershell.exe
256	powershell.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
5876	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Loads dropped DLL 3 IoCs

pid	Process
1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
5876	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
1	ipapi.co
7	ipapi.co

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4436	tasklist.exe
5040	tasklist.exe
4364	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4812	cmd.exe
5608	cmd.exe
1608	cmd.exe
4708	cmd.exe
3968	cmd.exe
6056	cmd.exe
1428	cmd.exe
6896	cmd.exe
4904	cmd.exe
7056	cmd.exe
6532	cmd.exe
3016	cmd.exe
6984	cmd.exe
5856	cmd.exe
3924	cmd.exe
1980	cmd.exe
6516	cmd.exe
5320	cmd.exe
3408	cmd.exe
5800	cmd.exe
6188	cmd.exe
2632	cmd.exe
2076	cmd.exe
7016	cmd.exe
2856	cmd.exe
4712	cmd.exe
5524	cmd.exe
1440	cmd.exe
7132	cmd.exe
6884	cmd.exe
5128	cmd.exe
6228	cmd.exe
2692	cmd.exe
4072	cmd.exe
5784	cmd.exe
2564	cmd.exe
3440	cmd.exe
6800	cmd.exe
5920	cmd.exe
200	cmd.exe
5824	cmd.exe
1764	cmd.exe
6704	cmd.exe
4740	cmd.exe
1772	cmd.exe
6736	cmd.exe
932	cmd.exe
6844	cmd.exe
3024	cmd.exe
1968	cmd.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6528	attrib.exe
5968	cmd.exe
6388	cmd.exe
5688	chrome.exe
3044	msedge.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4436	WMIC.exe
5448	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1344	ipconfig.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6112	taskkill.exe
4796	taskkill.exe

Modifies registry key 1 TTPs 52 IoCs

Modify Registry

T1112

pid	Process
5836	reg.exe
3360	reg.exe
2492	reg.exe
728	reg.exe
5412	reg.exe
5396	reg.exe
5336	reg.exe
6888	reg.exe
360	reg.exe
1924	reg.exe
6056	reg.exe
2404	reg.exe
3656	reg.exe
2160	reg.exe
5140	reg.exe
2984	reg.exe
1512	reg.exe
1448	reg.exe
568	reg.exe
2504	reg.exe
1672	reg.exe
6320	reg.exe
1120	reg.exe
6420	reg.exe
2432	reg.exe
2168	reg.exe
6012	reg.exe
3280	reg.exe
1280	reg.exe
3792	reg.exe
6012	reg.exe
6504	reg.exe
348	reg.exe
6088	reg.exe
3440	reg.exe
2008	reg.exe
1820	reg.exe
1676	reg.exe
5308	reg.exe
6596	reg.exe
3736	reg.exe
1600	reg.exe
4708	reg.exe
296	reg.exe
5716	reg.exe
6852	reg.exe
832	reg.exe
6396	reg.exe
4848	reg.exe
1256	reg.exe
2928	reg.exe
4832	reg.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6276	schtasks.exe
1044	schtasks.exe
1272	schtasks.exe
4944	schtasks.exe
1900	schtasks.exe
4352	schtasks.exe
2748	schtasks.exe
2192	schtasks.exe
6688	schtasks.exe
4708	schtasks.exe
4932	schtasks.exe
1584	schtasks.exe
3724	schtasks.exe
852	schtasks.exe
2336	schtasks.exe
6540	schtasks.exe
3180	schtasks.exe
804	schtasks.exe
968	schtasks.exe
5956	schtasks.exe
6584	schtasks.exe
4280	schtasks.exe
6204	schtasks.exe
596	schtasks.exe
3512	schtasks.exe
5988	schtasks.exe
6904	schtasks.exe
5568	schtasks.exe
1788	schtasks.exe
632	schtasks.exe
6792	schtasks.exe
5300	schtasks.exe
6388	schtasks.exe
6892	schtasks.exe
6480	schtasks.exe
4196	schtasks.exe
5616	schtasks.exe
5968	schtasks.exe
6656	schtasks.exe
6196	schtasks.exe
1120	schtasks.exe
4268	schtasks.exe
4968	schtasks.exe
1972	schtasks.exe
5040	schtasks.exe
5836	schtasks.exe
5828	schtasks.exe
3396	schtasks.exe
4424	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe
4176	powershell.exe
4176	powershell.exe
800	WMIC.exe
800	WMIC.exe
800	WMIC.exe
800	WMIC.exe
3316	powershell.exe
3316	powershell.exe
5448	WMIC.exe
5448	WMIC.exe
5448	WMIC.exe
5448	WMIC.exe
5236	powershell.exe
5236	powershell.exe
2624	powershell.exe
2624	powershell.exe
2928	WMIC.exe
2928	WMIC.exe
2928	WMIC.exe
2928	WMIC.exe
828	powershell.exe
828	powershell.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
5880	powershell.exe
5880	powershell.exe
4436	WMIC.exe
4436	WMIC.exe
4436	WMIC.exe
4436	WMIC.exe
1888	powershell.exe
1888	powershell.exe
1292	powershell.exe
1292	powershell.exe
2276	powershell.exe
2276	powershell.exe
6028	powershell.exe
6028	powershell.exe
4948	powershell.exe
4948	powershell.exe
5276	powershell.exe
5276	powershell.exe
6052	powershell.exe
6052	powershell.exe
1196	powershell.exe
1196	powershell.exe
1320	powershell.exe
1320	powershell.exe
6092	powershell.exe
6092	powershell.exe
2036	powershell.exe
2036	powershell.exe
3824	powershell.exe
3824	powershell.exe
2344	powershell.exe
2344	powershell.exe
916	powershell.exe
916	powershell.exe
4880	powershell.exe
4880	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeIncreaseQuotaPrivilege	800	WMIC.exe
Token: SeSecurityPrivilege	800	WMIC.exe
Token: SeTakeOwnershipPrivilege	800	WMIC.exe
Token: SeLoadDriverPrivilege	800	WMIC.exe
Token: SeSystemProfilePrivilege	800	WMIC.exe
Token: SeSystemtimePrivilege	800	WMIC.exe
Token: SeProfSingleProcessPrivilege	800	WMIC.exe
Token: SeIncBasePriorityPrivilege	800	WMIC.exe
Token: SeCreatePagefilePrivilege	800	WMIC.exe
Token: SeBackupPrivilege	800	WMIC.exe
Token: SeRestorePrivilege	800	WMIC.exe
Token: SeShutdownPrivilege	800	WMIC.exe
Token: SeDebugPrivilege	800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	800	WMIC.exe
Token: SeRemoteShutdownPrivilege	800	WMIC.exe
Token: SeUndockPrivilege	800	WMIC.exe
Token: SeManageVolumePrivilege	800	WMIC.exe
Token: 33	800	WMIC.exe
Token: 34	800	WMIC.exe
Token: 35	800	WMIC.exe
Token: 36	800	WMIC.exe
Token: SeIncreaseQuotaPrivilege	800	WMIC.exe
Token: SeSecurityPrivilege	800	WMIC.exe
Token: SeTakeOwnershipPrivilege	800	WMIC.exe
Token: SeLoadDriverPrivilege	800	WMIC.exe
Token: SeSystemProfilePrivilege	800	WMIC.exe
Token: SeSystemtimePrivilege	800	WMIC.exe
Token: SeProfSingleProcessPrivilege	800	WMIC.exe
Token: SeIncBasePriorityPrivilege	800	WMIC.exe
Token: SeCreatePagefilePrivilege	800	WMIC.exe
Token: SeBackupPrivilege	800	WMIC.exe
Token: SeRestorePrivilege	800	WMIC.exe
Token: SeShutdownPrivilege	800	WMIC.exe
Token: SeDebugPrivilege	800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	800	WMIC.exe
Token: SeRemoteShutdownPrivilege	800	WMIC.exe
Token: SeUndockPrivilege	800	WMIC.exe
Token: SeManageVolumePrivilege	800	WMIC.exe
Token: 33	800	WMIC.exe
Token: 34	800	WMIC.exe
Token: 35	800	WMIC.exe
Token: 36	800	WMIC.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeIncreaseQuotaPrivilege	5448	WMIC.exe
Token: SeSecurityPrivilege	5448	WMIC.exe
Token: SeTakeOwnershipPrivilege	5448	WMIC.exe
Token: SeLoadDriverPrivilege	5448	WMIC.exe
Token: SeSystemProfilePrivilege	5448	WMIC.exe
Token: SeSystemtimePrivilege	5448	WMIC.exe
Token: SeProfSingleProcessPrivilege	5448	WMIC.exe
Token: SeIncBasePriorityPrivilege	5448	WMIC.exe
Token: SeCreatePagefilePrivilege	5448	WMIC.exe
Token: SeBackupPrivilege	5448	WMIC.exe
Token: SeRestorePrivilege	5448	WMIC.exe
Token: SeShutdownPrivilege	5448	WMIC.exe
Token: SeDebugPrivilege	5448	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5448	WMIC.exe
Token: SeRemoteShutdownPrivilege	5448	WMIC.exe
Token: SeUndockPrivilege	5448	WMIC.exe
Token: SeManageVolumePrivilege	5448	WMIC.exe
Token: 33	5448	WMIC.exe
Token: 34	5448	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2996	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	88
PID 2996 wrote to memory of 3348	2996	powershell.exe	487
PID 1916 wrote to memory of 5876	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	91
PID 1916 wrote to memory of 4176	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	92
PID 4176 wrote to memory of 1840	4176	powershell.exe	94
PID 1840 wrote to memory of 800	1840	cmd.exe	297
PID 1916 wrote to memory of 3316	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	97
PID 3316 wrote to memory of 2868	3316	powershell.exe	99
PID 2868 wrote to memory of 5448	2868	cmd.exe	405
PID 1916 wrote to memory of 5236	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	101
PID 1916 wrote to memory of 2624	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	103
PID 2624 wrote to memory of 6032	2624	powershell.exe	105
PID 6032 wrote to memory of 2928	6032	cmd.exe	260
PID 1916 wrote to memory of 828	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	107
PID 828 wrote to memory of 4700	828	powershell.exe	109
PID 4700 wrote to memory of 2408	4700	cmd.exe	110
PID 1916 wrote to memory of 5880	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	111
PID 5880 wrote to memory of 2820	5880	powershell.exe	113
PID 2820 wrote to memory of 4436	2820	cmd.exe	264
PID 1916 wrote to memory of 1888	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	115
PID 1888 wrote to memory of 816	1888	powershell.exe	117
PID 816 wrote to memory of 4848	816	cmd.exe	314
PID 1916 wrote to memory of 1292	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	119
PID 1292 wrote to memory of 4864	1292	powershell.exe	121
PID 4864 wrote to memory of 5836	4864	cmd.exe	446
PID 1916 wrote to memory of 2276	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	123
PID 2276 wrote to memory of 5136	2276	powershell.exe	125
PID 5136 wrote to memory of 1924	5136	cmd.exe	126
PID 1916 wrote to memory of 6028	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	127
PID 6028 wrote to memory of 1880	6028	powershell.exe	129
PID 1880 wrote to memory of 3736	1880	cmd.exe	130
PID 1916 wrote to memory of 4948	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	131
PID 4948 wrote to memory of 1552	4948	powershell.exe	133
PID 1552 wrote to memory of 360	1552	cmd.exe	316
PID 1916 wrote to memory of 5276	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	135
PID 5276 wrote to memory of 5732	5276	powershell.exe	137
PID 5732 wrote to memory of 1512	5732	cmd.exe	464
PID 1916 wrote to memory of 6052	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	139
PID 6052 wrote to memory of 3200	6052	powershell.exe	141
PID 3200 wrote to memory of 5412	3200	cmd.exe	677
PID 1916 wrote to memory of 1196	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	143
PID 1196 wrote to memory of 5088	1196	powershell.exe	145
PID 5088 wrote to memory of 2432	5088	cmd.exe	283
PID 1916 wrote to memory of 1320	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	147
PID 1320 wrote to memory of 2716	1320	powershell.exe	149
PID 2716 wrote to memory of 2168	2716	cmd.exe	287
PID 1916 wrote to memory of 6092	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	151
PID 6092 wrote to memory of 884	6092	powershell.exe	153
PID 884 wrote to memory of 1600	884	cmd.exe	154
PID 1916 wrote to memory of 2036	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	155
PID 2036 wrote to memory of 6048	2036	powershell.exe	157
PID 6048 wrote to memory of 6056	6048	cmd.exe	374
PID 1916 wrote to memory of 3824	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	159
PID 3824 wrote to memory of 1928	3824	powershell.exe	161
PID 1928 wrote to memory of 4708	1928	cmd.exe	589
PID 1916 wrote to memory of 2344	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	163
PID 2344 wrote to memory of 960	2344	powershell.exe	165
PID 960 wrote to memory of 348	960	cmd.exe	207
PID 1916 wrote to memory of 916	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	167
PID 916 wrote to memory of 3600	916	powershell.exe	169
PID 3600 wrote to memory of 296	3600	cmd.exe	393
PID 1916 wrote to memory of 4880	1916	2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	171
PID 4880 wrote to memory of 2392	4880	powershell.exe	173
PID 2392 wrote to memory of 5040	2392	cmd.exe	425

Views/modifies file attributes 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2512	attrib.exe
2668	attrib.exe
4192	attrib.exe
3352	attrib.exe
6072	attrib.exe
2440	attrib.exe
7136	attrib.exe
1788	attrib.exe
5848	attrib.exe
1672	attrib.exe
3916	attrib.exe
6528	attrib.exe
252	attrib.exe
2052	attrib.exe
3792	attrib.exe
1700	attrib.exe
6636	attrib.exe
6804	attrib.exe
6436	attrib.exe
1680	attrib.exe
1212	attrib.exe
3712	attrib.exe
6608	attrib.exe
7108	attrib.exe
3360	attrib.exe
3052	attrib.exe
6232	attrib.exe
2252	attrib.exe
4712	attrib.exe
3008	attrib.exe
412	attrib.exe
7144	attrib.exe
3028	attrib.exe
6812	attrib.exe
6924	attrib.exe
2116	attrib.exe
6936	attrib.exe
1240	attrib.exe
2404	attrib.exe
3792	attrib.exe
3388	attrib.exe
5504	attrib.exe
3016	attrib.exe
6948	attrib.exe
4220	attrib.exe
3692	attrib.exe
5044	attrib.exe
7032	attrib.exe
3168	attrib.exe
1676	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3348
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe --watchdog 1916
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic logicaldisk where "DriveType=3" get Size /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic logicaldisk where DriveType=3 get Size /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where DriveType=3 get Size /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools
      4⤵
      Modifies registry key
      PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
      4⤵
      Modifies registry key
      PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5136
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:1924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:3736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs
      4⤵
      Modifies registry key
      PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\QEMU" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\QEMU 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\QEMU
      4⤵
      Modifies registry key
      PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Parallels" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Parallels 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Parallels
      4⤵
      Modifies registry key
      PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Wine" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Wine 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wine
      4⤵
      Identifies Wine through registry keys
      Modifies registry key
      PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn
      4⤵
      Looks for Xen service registry key.
      Modifies registry key
      PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      4⤵
      Modifies registry key
      PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Cuckoo" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Cuckoo 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Cuckoo
      4⤵
      Modifies registry key
      PID:348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\JoeBox" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\JoeBox 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\JoeBox
      4⤵
      Modifies registry key
      PID:296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /FO CSV /NH'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /FO CSV /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'getmac /FO CSV /NH'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "getmac /FO CSV /NH"
    3⤵
    PID:2480
  - - C:\Windows\system32\getmac.exe
      getmac /FO CSV /NH
      4⤵
      PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'driverquery /FO CSV'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3664
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "driverquery /FO CSV"
    3⤵
    PID:3268
  - - C:\Windows\system32\driverquery.exe
      driverquery /FO CSV
      4⤵
      PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic computersystem get Manufacturer,Model /format:csv'"
  2⤵
  PID:908
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic computersystem get Manufacturer,Model /format:csv"
    3⤵
    PID:2656
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer,Model /format:csv
      4⤵
      PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2368
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
    3⤵
    PID:5652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
      4⤵
      PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use'"
  2⤵
  PID:2712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "net use"
    3⤵
    PID:3876
  - - C:\Windows\system32\net.exe
      net use
      4⤵
      PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /NH'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4788
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /NH"
    3⤵
    PID:5908
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH
      4⤵
      Enumerates processes with tasklist
      PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s 2>nul'"
  2⤵
  PID:3496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s 2>nul"
    3⤵
    PID:1276
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic diskdrive get SerialNumber /format:csv'"
  2⤵
  PID:3328
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic diskdrive get SerialNumber /format:csv"
    3⤵
    PID:348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get SerialNumber /format:csv
      4⤵
      PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" 2>nul'"
  2⤵
  PID:4548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState 2>nul"
    3⤵
    PID:3040
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState
      4⤵
      Modifies registry key
      PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81|C:\Users\Admin\AppData\Local\Temp\\out_A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81_1783528102679|1916|1783528102918" /f 2>nul'"
  2⤵
  PID:2428
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START|A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81|C:\Users\Admin\AppData\Local\Temp\\out_A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81_1783528102679|1916|1783528102918 /f 2>nul"
    3⤵
    PID:4764
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START
      4⤵
      Modifies registry key
      PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateCache" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1783528106905" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1783528106905 /f 2>nul"
    3⤵
    PID:5340
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
      4⤵
      Modifies registry key
      PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jusched.exe 2>nul'"
  2⤵
  PID:4984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jusched.exe 2>nul"
    3⤵
    PID:3292
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jusched.exe
      4⤵
      Kills process with taskkill
      PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jucheck.exe 2>nul'"
  2⤵
  PID:1180
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jucheck.exe 2>nul"
    3⤵
    PID:2744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jucheck.exe
      4⤵
      Kills process with taskkill
      PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2952
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:2540
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1388
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:1708
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:1768
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  PID:2040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:2548
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:5712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f 2>nul"
    3⤵
    PID:3756
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:3304
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f 2>nul"
    3⤵
    PID:5436
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jucheck" /f 2>nul'"
  2⤵
  PID:3804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f 2>nul"
    3⤵
    PID:5104
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /V /FO CSV'"
  2⤵
  PID:3932
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /V /FO CSV"
    3⤵
    PID:4288
  - - C:\Windows\system32\tasklist.exe
      tasklist /V /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jucheck" /f 2>nul'"
  2⤵
  PID:1232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f 2>nul"
    3⤵
    PID:5952
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "svchost" /f 2>nul'"
  2⤵
  PID:2280
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f 2>nul"
    3⤵
    PID:2864
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2396
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f 2>nul"
    3⤵
    PID:920
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  PID:2980
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:3576
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  PID:3548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:1112
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:5716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  PID:2432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:1560
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  PID:2168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:3148
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:468
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:1260
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  PID:4952
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:800
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:3452
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f
      4⤵
      Modifies registry key
      PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:5560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:3176
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f
      4⤵
      Modifies registry key
      PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  PID:204
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:2696
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path SoftwareLicensingProduct where PartialProductKey!=null get Name,LicenseStatus,PartialProductKey /format:csv'"
  2⤵
  PID:5408
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path SoftwareLicensingProduct where PartialProductKey!=null get Name,LicenseStatus,PartialProductKey /format:csv"
    3⤵
    PID:2536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where PartialProductKey!=null get Name,LicenseStatus,PartialProductKey /format:csv
      4⤵
      PID:360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  PID:4848
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:4388
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  PID:5396
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:3280
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'ipconfig /all'"
  2⤵
  PID:4432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "ipconfig /all"
    3⤵
    PID:5592
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:3284
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "SYSINFO_DONE|A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81|C:\Users\Admin\AppData\Local\Temp\\out_A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81_1783528102679|1916|1783528112603" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1412
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE|A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81|C:\Users\Admin\AppData\Local\Temp\\out_A8816E5F-5B0E-45D7-BBC2-5A967AF9FE81_1783528102679|1916|1783528112603 /f 2>nul"
    3⤵
    PID:2784
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE
      4⤵
      Modifies registry key
      PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate" 2>nul'"
  2⤵
  PID:5080
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5856
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate
      4⤵
      Views/modifies file attributes
      PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1c0,0x1c4,0x1c8,0x19c,0x1cc,0x7ffea226c728,0x7ffea226c734,0x7ffea226c740
    3⤵
    PID:2600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:1556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --force-high-res-timeticks=disabled --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
    3⤵
    PID:984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:9
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
    3⤵
    PID:3640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:9
    3⤵
    PID:1804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2196,i,8275132789401637922,1468537913878597826,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
    3⤵
    PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" 2>nul'"
  2⤵
  PID:6096
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:5024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate" 2>nul'"
  2⤵
  PID:5972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate
      4⤵
      Views/modifies file attributes
      PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" 2>nul'"
  2⤵
  PID:4368
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe
      4⤵
      Views/modifies file attributes
      PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2568
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6080
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4784
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2584
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter
      4⤵
      Views/modifies file attributes
      PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" 2>nul'"
  2⤵
  PID:1300
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe
      4⤵
      Views/modifies file attributes
      PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:3828
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:1452
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:296
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config" 2>nul'"
  2⤵
  PID:1360
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5784
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config
      4⤵
      Views/modifies file attributes
      PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" 2>nul'"
  2⤵
  PID:1380
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4812
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe
      4⤵
      Views/modifies file attributes
      PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3008
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service" 2>nul'"
  2⤵
  PID:1884
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1764
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service
      4⤵
      Views/modifies file attributes
      PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:3752
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3924
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4480
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5816
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service" 2>nul'"
  2⤵
  PID:3444
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5608
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service
      4⤵
      Views/modifies file attributes
      PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5468
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe
      4⤵
      Views/modifies file attributes
      PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x280,0x7ffea209c188,0x7ffea209c194,0x7ffea209c1a0
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:9
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:9
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:9
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:9
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:9
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2168,i,1685944073968381981,10673077661270685971,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:6548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:3464
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1216
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4584
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:108
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update" 2>nul'"
  2⤵
  PID:6112
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3440
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update
      4⤵
      Views/modifies file attributes
      PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" 2>nul'"
  2⤵
  PID:5996
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2076
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2736
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5616
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1692
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host" 2>nul'"
  2⤵
  PID:5892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1608
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host
      4⤵
      Views/modifies file attributes
      PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4120
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1280
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe
      4⤵
      Views/modifies file attributes
      PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3696
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1632
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2764
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6780
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig" 2>nul'"
  2⤵
  PID:6836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1440
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig
      4⤵
      Views/modifies file attributes
      PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'robocopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network" "C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528123031_8340_rb_dir" Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7028
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "robocopy C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528123031_8340_rb_dir Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP"
    3⤵
    PID:3428
  - - C:\Windows\system32\Robocopy.exe
      robocopy C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528123031_8340_rb_dir Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP
      4⤵
      PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" 2>nul'"
  2⤵
  PID:2504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe
      4⤵
      Views/modifies file attributes
      PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4068
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc" 2>nul'"
  2⤵
  PID:5140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7132
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc
      4⤵
      Views/modifies file attributes
      PID:7144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5504
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe
      4⤵
      Views/modifies file attributes
      PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3640
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4244
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate" 2>nul'"
  2⤵
  PID:3376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6800
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate
      4⤵
      Views/modifies file attributes
      PID:3028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" 2>nul'"
  2⤵
  PID:2160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe
      4⤵
      Views/modifies file attributes
      PID:6812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2496
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4476
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6404
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6756
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry
      4⤵
      Views/modifies file attributes
      PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe" 2>nul'"
  2⤵
  PID:2880
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6704
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe
      4⤵
      Views/modifies file attributes
      PID:6608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6648
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5500
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service" 2>nul'"
  2⤵
  PID:4196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5920
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service
      4⤵
      Views/modifies file attributes
      PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe" 2>nul'"
  2⤵
  PID:6268
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe
      4⤵
      Views/modifies file attributes
      PID:6936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6712
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:2680
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:7128
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp" 2>nul'"
  2⤵
  PID:6964
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp
      4⤵
      Views/modifies file attributes
      PID:7108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe" 2>nul'"
  2⤵
  PID:1284
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4708
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe
      4⤵
      Views/modifies file attributes
      PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1144
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3012
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2348
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache" 2>nul'"
  2⤵
  PID:6212
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache
      4⤵
      Views/modifies file attributes
      PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe" 2>nul'"
  2⤵
  PID:6412
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe
      4⤵
      Views/modifies file attributes
      PID:6636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1240
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6428
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6384
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3544
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0" 2>nul'"
  2⤵
  PID:5692
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3024
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0
      4⤵
      Views/modifies file attributes
      PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe" 2>nul'"
  2⤵
  PID:2172
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4904
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6460
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6936
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:5804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS" 2>nul'"
  2⤵
  PID:4192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7016
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS
      4⤵
      Views/modifies file attributes
      PID:7136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6980
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe
      4⤵
      Views/modifies file attributes
      PID:6948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7072
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:7112
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:7064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1400
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery" 2>nul'"
  2⤵
  PID:3248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2856
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery
      4⤵
      Views/modifies file attributes
      PID:6804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:3920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6532
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:6528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1500
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:5968
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:6388
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4772
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1772
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework
      4⤵
      Views/modifies file attributes
      PID:6436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe" 2>nul'"
  2⤵
  PID:6492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3016
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:6232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6008
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5412
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling" 2>nul'"
  2⤵
  PID:3956
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:200
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling
      4⤵
      Views/modifies file attributes
      PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe
      4⤵
      Views/modifies file attributes
      PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2964
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:3724
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4944
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:7044
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1636
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5320
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache
      4⤵
      Views/modifies file attributes
      PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3028
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3408
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe
      4⤵
      Views/modifies file attributes
      PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4344
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6072
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6392
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials" 2>nul'"
  2⤵
  PID:6424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5800
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials
      4⤵
      Views/modifies file attributes
      PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe" 2>nul'"
  2⤵
  PID:5976
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe
      4⤵
      Views/modifies file attributes
      PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2824
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6724
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates" 2>nul'"
  2⤵
  PID:6300
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates
      4⤵
      Views/modifies file attributes
      PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe" 2>nul'"
  2⤵
  PID:3048
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6736
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe
      4⤵
      Views/modifies file attributes
      PID:6924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5960
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6784
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:7144
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization" 2>nul'"
  2⤵
  PID:4992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization
      4⤵
      Views/modifies file attributes
      PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4712
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe
      4⤵
      Views/modifies file attributes
      PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6152
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:5480
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2408
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady
      4⤵
      Views/modifies file attributes
      PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3076
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2692
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe
      4⤵
      Views/modifies file attributes
      PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6364
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6148
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5124
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f"
    3⤵
    PID:6296
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f
      4⤵
      Modifies registry key
      PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" /f'"
  2⤵
  PID:3852
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f"
    3⤵
    PID:4260
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f
      4⤵
      Modifies registry key
      PID:6320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsMediaCfg" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" /f'"
  2⤵
  PID:7156
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f"
    3⤵
    PID:6908
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f
      4⤵
      Modifies registry key
      PID:6852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchFilterHost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" /f'"
  2⤵
  PID:6916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f"
    3⤵
    PID:2468
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f
      4⤵
      Modifies registry key
      PID:6504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateAgent" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f"
    3⤵
    PID:7052
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" /f'"
  2⤵
  PID:5012
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f"
    3⤵
    PID:252
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f
      4⤵
      Modifies registry key
      PID:6888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2928
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f"
    3⤵
    PID:4268
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f
      4⤵
      Modifies registry key
      PID:5308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocol" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" /f'"
  2⤵
  PID:728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f"
    3⤵
    PID:3124
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f
      4⤵
      Modifies registry key
      PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f"
    3⤵
    PID:2924
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f
      4⤵
      Modifies registry key
      PID:6396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f"
    3⤵
    PID:6408
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f
      4⤵
      Modifies registry key
      PID:6420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "CryptoCertSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f"
    3⤵
    PID:4892
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f
      4⤵
      Modifies registry key
      PID:6596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:4832
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6956
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier 2>nul"
    3⤵
    PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier 2>nul"
    3⤵
    PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1628
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier 2>nul"
    3⤵
    PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6100
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2748
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier 2>nul"
    3⤵
    PID:5940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6396
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:2356
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:6176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'robocopy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network" "C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528183061_7074_rb_dir" Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:52
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "robocopy C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528183061_7074_rb_dir Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP"
    3⤵
    PID:1680
  - - C:\Windows\system32\Robocopy.exe
      robocopy C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1783528183061_7074_rb_dir Cookies Cookies-wal Cookies-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP
      4⤵
      PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SearchFilterHost.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier
Size 13B
SHA256 12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028
MD5 38de427224a5082a04fe82e2bd4ea9ec
SHA1 7e4a53de1f83762dd2febd39b818e2258bc83bc1
SHA512 ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

nyx_host.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WSUS\nyx_host\1916\nyx_host.dll
Size 65KB
SHA256 744d93ec7fbed80368e085484afb1df5ab031a45b7c11b5e700c6f8f07b27c89
MD5 ef7c5f46a9d7d91ab9b3d43b511aa8e9
SHA1 1c308a4d165cc693af31d97ac909c897188821fc
SHA512 377428d966315d7ba39c6f27aea2495ff3595835c63c7aa0daf05a14b42d436c1ae7ac38604c1ab748996a7887479a2f60bd90ad07211fcf9e58970963df4aaa
SSDEEP 768:6rV+K78IoPltQIzcvqeLFpQD0gM7sv0CSk/xcRsYFr98KTXy7a:6rV+K7eleQOpQD06ak/xcRsolTv
TLSH
T15753C61AF7A75C4CC1A5D27CA7C642B16AFDBD049972672E025615323F2EEB08F38B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuauclt.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WSUS\wuauclt.log
Size 1KB
SHA256 96519f425ce9e7ab57acc5c1eec7bb09232b6559e20ee55a80d037415b550e93
MD5 54f6fc07c2c8c3861dc06c27412ba812
SHA1 98f35a468ee8370eabbbe0d65871c63564805060
SHA512 3fcf79c07ba94ed1cd6a6935284c6edaea9ee6616fd71620c8c2dd724e7b95354ef0bb63c7e640bdb4e6e8ad92e2bc620891bc652914518e695f8d68abe175eb
TLSH
T1A13139895FBBE0B77C3D949D91218AB88686F313821224E5F75C13983317C4B8F798D1
MD5 SHA1 SHA512 TLSH

Submit Download

wuauclt.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WSUS\wuauclt.log
Size 1KB
SHA256 3cb4f1c67d4b5afa967259d989d0c36ed477189b0b3413a85059f5fecba0cd43
MD5 fac775fd380a126b26039fedec1672cb
SHA1 9c6b5f70b616d96589bd0e6a7df1a106fd783b36
SHA512 8e3e5fb4020737a33b86fcc5159af41f592dbfc80e3b6fc7e32b9abfe4f93561b7cebaa6b95105c4ad2b46df77ff9d74bb5c8dd3d7b8a93d96c296cba927e740
TLSH
T14811D69C5B7BA0B7BC7D989E9020CBB8868AF362951214E0F75C13943312D4B9F799D4
MD5 SHA1 SHA512 TLSH

Submit Download

wuauclt.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WSUS\wuauclt.log
Size 4KB
SHA256 f266335357cc78cab78abcd30d2e62f99d032c341fe812d1052263f068103c84
MD5 c3de68b0fc6619d44dd79c1ce7e06b95
SHA1 87c73dac1fdb4e61ad5553fdb34f0333bc439fd3
SHA512 5b2c93d6b8333c22ecde3d1808e03005bcbba05ebb72858909058785fc08e5211da09352e3b60f14538ea8f3c19e33311985ea70e36c88470b92f321004478ea
SSDEEP 96:oSckmFMghtqupvvfqwjdhTsrmOVgYl6SKh1cRUloWm1GEQq4zqIzqh/naN2ONlNh:Jc5RhtFpv3qwHTsPCYl6SKh1cRUldm1w
TLSH
T141A19E948BAFE0B77D69649E911189AC8295F343AA4739A1F324139C3353C4FCEB68D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_f51e9bc49f162fcd532b845ff3ec9de6_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
Size 37.9MB
SHA256 f12df6c775fe63b201c6c20b9dd89fa9bdafc2bbccd9ecc98b4a6460425d551f
MD5 f51e9bc49f162fcd532b845ff3ec9de6
SHA1 6742fcf850ae6ab0a01c664a3691744be0efe2bd
SHA512 003c47be36729219e3039038e97cc031bf7c2f0a6db02860d941e40e9de256ebc2ed89ee6b73f8a29d26e8cf7d051a0616bb29a043fbfd9278a17f27a269c270
SSDEEP 393216:HuzYCDUnIvxMKOgN9l5qx40Y1MSQsq6rOhP4IXF7gwE1H:OcCiK3HMSk6rOM1H
TLSH
T1C9977D26A6D940EDC497807D0D9582A2BF337C4647309AEBD08975726E33AF4EB3D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3528240778546\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Crashpad\settings.dat
Size 280B
SHA256 62f98b1009752d7ab4a1d73ca8bbf4f766961e0376f2e9e72e69eaa657626b84
MD5 f39306c7cebc1633cfe1ddd53328bca6
SHA1 191abfffe8b1f6507e24d4124bc43673749ee0c7
SHA512 6948b51a6ca53ee0c22809664c3543cf54e0bc21573d4eb08466f100e93f1b5752a786b19e08b363b46ce42a58015e6cab0ccc9121068d7f721f3e165371a08e
TLSH
T14CD02220B300E288C208C0F28800830A0A20CF220CA20A0032B0BC0C0C03E0802C20F2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Local State
Size 4KB
SHA256 f003f86eecad2e58fbdd7939b6cb98b05fee083ffa86d6c0885c833d49ceb509
MD5 7f83dee968105f64cc4940fab96d62eb
SHA1 d31eb34b494856c7371f0256d874c7ad6a720d5a
SHA512 2fdd263c4da48685f8b7e0447c1e43062b14c5d552654b6f3cf33da1bd4ca58b9532e1fc283f8ef34dfccd4ce6d1a9c1cdee481a712626cd592fc05fa964c265
SSDEEP 96:yqGNk5sIMft5WIR1vvDAEBBHvDrbQR0x4UpgoSDS4SYSuSDSDS+q4a:JGNiH+5jDAoVbQR0gW
TLSH
T14E81B6736820AC7B6EE14684B14A3513CF74A227DB457B9467DC230C0AEF56CD30AC76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Local State
Size 5KB
SHA256 52aadfa17242281a769f2dd4d9962b4416c2ade42ae5d4c9ac564473833b96e0
MD5 ae42df07910c7e6bfa1ab8fc1f70a10e
SHA1 af8d10ed722d5bf67de57445df468d3e8e3fb3d8
SHA512 3e445a15ea0fb7fd86f1f392abf900d3b3d0fc81fae172fb4fd15168afa1b1716e105cd0a9a2d1f2bae6266940fa331315007ed26c361b4a2abe17730d3f8f58
SSDEEP 96:yqGNkOQsjpft5WIR58Frh/cInURcDotovikDADBBHvDrbQR0x4UpgoSDS4SYSuSr:JGNC6T5gocDUwjAdVbQR0gW
TLSH
T15EB1C9336874EC7B5EE19640B48535139FB49237EA887F98D7DC170C0AEF2589346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a15bc.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4928240784203\Local State~RFe5a15bc.TMP
Size 1KB
SHA256 4e086e2e89ba0e9f5f1222a37b1a4fe627a3eaf27c61c01023b1ef8a93c299dc
MD5 1797c261d9f59c9501e9f72adbc3ee7f
SHA1 d41b9938ed64116e305c26df2b3a4e0dd9eecafa
SHA512 962472caee2adcce581b5fd7075889d761fe5139f414a1b73b245a0591be1ccd4e6ac3d0d902712a12959697e02db6ad797c81bc4f0070813ba70ac1b5ceee77
TLSH
T13331A8716CA478BBF8624206B249B667AF74317595512B4C67DC470C05E335C732FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_apq3vvox.jl0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_apq3vvox.jl0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1916-332-0x00007FFEA2C80000-0x00007FFEA2D75000-memory.dmp

Download

memory/1916-87-0x00007FFEC1C30000-0x00007FFEC1C48000-memory.dmp

Download

memory/1916-904-0x00007FFEA2C80000-0x00007FFEA2D75000-memory.dmp

Download

memory/2996-15-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/2996-12-0x000002CCF15A0000-0x000002CCF15C2000-memory.dmp

Download

memory/2996-19-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/2996-18-0x00007FFEA93D0000-0x00007FFEA9D74000-memory.dmp

Download

memory/2996-11-0x00007FFEA955F000-0x00007FFEA9560000-memory.dmp

Download

memory/5876-106-0x00007FFEC1A90000-0x00007FFEC1AA8000-memory.dmp

Download