1e348009a851cb615cb4008caa79f70ca113c48af713e0286454cc50ac751034

Analysis

max time kernel
30s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 22.8MB
Sample260728-yn7ppsgl5z
SHA256 1e348009a851cb615cb4008caa79f70ca113c48af713e0286454cc50ac751034
MD5 d1dfd113c406902fbdc735dc54707f5e
SHA1 34fa0cd42f35ade8ab9061400479a8e4d30134fc
SHA512 deca4fc8d89a78baf24a9f0d1fecf30ec755b448c5cc23ce10686beb3b6d511ba7529504e72091a1143e2d86f249c31d10d1269f03120524601a0268ae9811ee
SSDEEP 196608:b7QV+NAeNdTzKVy2dxctQNpGObcyRVUvXbbsz0MF/spVR0qpNK:bcou0TzKVyy7NAScyubGfypX0UK
TLSH
T1CF378C97FC7404D4C0EEC63189A695267BA13C494B3123DB5B92FA247F36BD09EBA704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4432	netsh.exe
4948	netsh.exe
4148	netsh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5976	powershell.exe
5496	powershell.exe
1984	powershell.exe
2312	powershell.exe
2060	powershell.exe
4872	powershell.exe
1292	powershell.exe
5992	powershell.exe
2256	powershell.exe
5784	powershell.exe
2308	powershell.exe
1216	powershell.exe
4244	powershell.exe
3444	powershell.exe
3228	powershell.exe
4196	powershell.exe
4908	powershell.exe
3324	powershell.exe
5360	powershell.exe
2104	powershell.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4844	powercfg.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
5276	tasklist.exe
2452	tasklist.exe
4476	tasklist.exe
2076	tasklist.exe
4296	tasklist.exe
3972	tasklist.exe
1908	tasklist.exe
2708	tasklist.exe
1756	tasklist.exe
5940	tasklist.exe
1492	tasklist.exe
2168	tasklist.exe
2396	tasklist.exe
5420	tasklist.exe
4192	tasklist.exe
3064	tasklist.exe
3812	tasklist.exe
2640	tasklist.exe
5112	tasklist.exe
2728	tasklist.exe
4872	tasklist.exe
5496	tasklist.exe
6048	tasklist.exe
1076	tasklist.exe
5192	tasklist.exe
720	tasklist.exe
2016	tasklist.exe
1388	tasklist.exe
2312	tasklist.exe
4100	tasklist.exe
5260	tasklist.exe
3176	tasklist.exe
4884	tasklist.exe
4892	tasklist.exe
2216	tasklist.exe
4284	tasklist.exe
4868	tasklist.exe
1428	tasklist.exe
3408	tasklist.exe
1280	tasklist.exe
4892	tasklist.exe
1688	tasklist.exe
5840	tasklist.exe
3648	tasklist.exe
5968	tasklist.exe
1508	tasklist.exe
2036	tasklist.exe
3952	tasklist.exe
2396	tasklist.exe
5548	tasklist.exe
3228	tasklist.exe
2344	tasklist.exe
1040	tasklist.exe
2452	tasklist.exe
4524	tasklist.exe
3652	tasklist.exe
468	tasklist.exe
3528	tasklist.exe
6128	tasklist.exe
6004	tasklist.exe
1280	tasklist.exe
2044	tasklist.exe
456	tasklist.exe
364	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4960	cscript.exe
2116	cscript.exe
3848	cscript.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 45 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2328	powershell.exe
4496	powershell.exe
4684	powershell.exe
2640	powershell.exe
4788	powershell.exe
4620	powershell.exe
608	powershell.exe
3160	powershell.exe
1580	powershell.exe
4884	powershell.exe
4292	powershell.exe
4340	powershell.exe
1812	powershell.exe
2284	powershell.exe
3208	powershell.exe
5480	powershell.exe
1700	powershell.exe
1692	powershell.exe
3240	powershell.exe
5496	powershell.exe
3336	powershell.exe
2344	powershell.exe
4344	powershell.exe
3320	powershell.exe
2800	powershell.exe
5260	powershell.exe
200	powershell.exe
4308	powershell.exe
3328	powershell.exe
5976	powershell.exe
3692	powershell.exe
1984	powershell.exe
3968	powershell.exe
4660	powershell.exe
1896	powershell.exe
5604	powershell.exe
248	powershell.exe
4288	powershell.exe
5072	powershell.exe
3352	powershell.exe
468	powershell.exe
4220	powershell.exe
1988	powershell.exe
5044	powershell.exe
6004	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3256	sc.exe
3392	sc.exe
5096	sc.exe
3304	sc.exe
4324	sc.exe
3244	sc.exe
3004	sc.exe
6072	sc.exe
1068	sc.exe
6128	sc.exe
808	sc.exe
4856	sc.exe
4900	sc.exe
3324	sc.exe
456	sc.exe
824	sc.exe
2120	sc.exe
2808	sc.exe
3484	sc.exe
2312	sc.exe
4188	sc.exe
4188	sc.exe
2936	sc.exe
4660	sc.exe
4436	sc.exe
4560	sc.exe
900	sc.exe
616	sc.exe
1504	sc.exe
4540	sc.exe
2724	sc.exe
5632	sc.exe
2384	sc.exe
3788	sc.exe
2524	sc.exe
4240	sc.exe
4484	sc.exe
2828	sc.exe
2732	sc.exe
2312	sc.exe
1288	sc.exe
3340	sc.exe
4868	sc.exe
4560	sc.exe
5300	sc.exe
2284	sc.exe
2728	sc.exe
4856	sc.exe
1224	sc.exe
2116	sc.exe
5224	sc.exe
6128	sc.exe
2620	sc.exe
5192	sc.exe
5036	sc.exe
5440	sc.exe
2912	sc.exe
3980	sc.exe
1992	sc.exe
5016	sc.exe
4524	sc.exe
1124	sc.exe
1688	sc.exe
2388	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
1096	cmd.exe
2848	cmd.exe
5096	cmd.exe
4688	cmd.exe
360	cmd.exe
5620	cmd.exe
4816	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4640	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2812	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	dotnet.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2812	netstat.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5696	reg.exe
2936	reg.exe
4948	reg.exe
4680	reg.exe
3256	reg.exe
3240	reg.exe
1580	reg.exe
4432	reg.exe
5152	reg.exe
4644	reg.exe
1892	reg.exe
1396	reg.exe
4344	reg.exe
344	reg.exe
2292	reg.exe
2184	reg.exe
2948	reg.exe
2356	reg.exe
5056	reg.exe
1360	reg.exe
4100	reg.exe
5944	reg.exe
4328	reg.exe
2620	reg.exe
5976	reg.exe
4344	reg.exe
1100	reg.exe
4924	reg.exe
1144	reg.exe
1776	reg.exe
6004	reg.exe
2732	reg.exe
1988	reg.exe
2424	reg.exe
1288	reg.exe
2016	reg.exe
476	reg.exe
6004	reg.exe
4816	reg.exe
1692	reg.exe
5904	reg.exe
3328	reg.exe
5440	reg.exe
3256	reg.exe
2624	reg.exe
2620	reg.exe
2212	reg.exe
1560	reg.exe
2864	reg.exe
4220	reg.exe
2924	reg.exe
4644	reg.exe
3328	reg.exe
2848	reg.exe
2612	reg.exe
4220	reg.exe
3132	reg.exe
2620	reg.exe
1308	reg.exe
3444	reg.exe
5508	reg.exe
4884	reg.exe
2076	reg.exe
4100	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	powershell.exe
1292	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
1292	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
3444	powershell.exe
3444	powershell.exe
3444	powershell.exe
5360	powershell.exe
5360	powershell.exe
5360	powershell.exe
3228	powershell.exe
3228	powershell.exe
3228	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
4196	powershell.exe
4196	powershell.exe
4196	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe
4340	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4844	powercfg.exe
Token: SeCreatePagefilePrivilege	4844	powercfg.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeIncreaseQuotaPrivilege	1292	powershell.exe
Token: SeSecurityPrivilege	1292	powershell.exe
Token: SeTakeOwnershipPrivilege	1292	powershell.exe
Token: SeLoadDriverPrivilege	1292	powershell.exe
Token: SeSystemProfilePrivilege	1292	powershell.exe
Token: SeSystemtimePrivilege	1292	powershell.exe
Token: SeProfSingleProcessPrivilege	1292	powershell.exe
Token: SeIncBasePriorityPrivilege	1292	powershell.exe
Token: SeCreatePagefilePrivilege	1292	powershell.exe
Token: SeBackupPrivilege	1292	powershell.exe
Token: SeRestorePrivilege	1292	powershell.exe
Token: SeShutdownPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeSystemEnvironmentPrivilege	1292	powershell.exe
Token: SeRemoteShutdownPrivilege	1292	powershell.exe
Token: SeUndockPrivilege	1292	powershell.exe
Token: SeManageVolumePrivilege	1292	powershell.exe
Token: 33	1292	powershell.exe
Token: 34	1292	powershell.exe
Token: 35	1292	powershell.exe
Token: 36	1292	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeIncreaseQuotaPrivilege	1292	powershell.exe
Token: SeSecurityPrivilege	1292	powershell.exe
Token: SeTakeOwnershipPrivilege	1292	powershell.exe
Token: SeLoadDriverPrivilege	1292	powershell.exe
Token: SeSystemProfilePrivilege	1292	powershell.exe
Token: SeSystemtimePrivilege	1292	powershell.exe
Token: SeProfSingleProcessPrivilege	1292	powershell.exe
Token: SeIncBasePriorityPrivilege	1292	powershell.exe
Token: SeCreatePagefilePrivilege	1292	powershell.exe
Token: SeBackupPrivilege	1292	powershell.exe
Token: SeRestorePrivilege	1292	powershell.exe
Token: SeShutdownPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeSystemEnvironmentPrivilege	1292	powershell.exe
Token: SeRemoteShutdownPrivilege	1292	powershell.exe
Token: SeUndockPrivilege	1292	powershell.exe
Token: SeManageVolumePrivilege	1292	powershell.exe
Token: 33	1292	powershell.exe
Token: 34	1292	powershell.exe
Token: 35	1292	powershell.exe
Token: 36	1292	powershell.exe
Token: SeDebugPrivilege	2812	netstat.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemProfilePrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeProfSingleProcessPrivilege	3320	powershell.exe
Token: SeIncBasePriorityPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1292	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4508 wrote to memory of 4844	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4508 wrote to memory of 4908	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 4508 wrote to memory of 3256	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 4508 wrote to memory of 2156	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 4508 wrote to memory of 960	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 4508 wrote to memory of 3208	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 4508 wrote to memory of 3324	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 4508 wrote to memory of 3480	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 4508 wrote to memory of 1216	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 4508 wrote to memory of 5476	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 4508 wrote to memory of 2060	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 4508 wrote to memory of 5992	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 4508 wrote to memory of 4872	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	928
PID 4508 wrote to memory of 2812	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1184
PID 4508 wrote to memory of 2900	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	120
PID 4508 wrote to memory of 2256	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	224
PID 4508 wrote to memory of 3320	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	331
PID 4508 wrote to memory of 4244	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	226
PID 4508 wrote to memory of 3444	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	920
PID 4508 wrote to memory of 5360	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	131
PID 4508 wrote to memory of 5944	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	332
PID 4508 wrote to memory of 4652	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	135
PID 4508 wrote to memory of 3228	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1034
PID 4508 wrote to memory of 4748	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1071
PID 4508 wrote to memory of 2248	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1340
PID 4508 wrote to memory of 5480	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1054
PID 4508 wrote to memory of 1700	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	145
PID 4508 wrote to memory of 2848	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	792
PID 4508 wrote to memory of 4852	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	649
PID 4508 wrote to memory of 6128	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	952
PID 4508 wrote to memory of 4564	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	151
PID 4508 wrote to memory of 4288	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1276
PID 4508 wrote to memory of 4292	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1273
PID 4508 wrote to memory of 4196	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	157
PID 4508 wrote to memory of 2328	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	906
PID 4508 wrote to memory of 4496	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	718
PID 4508 wrote to memory of 4640	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	333
PID 4508 wrote to memory of 4340	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1250
PID 4508 wrote to memory of 2356	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	166
PID 4508 wrote to memory of 4908	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1345
PID 4508 wrote to memory of 2452	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1006
PID 4508 wrote to memory of 2800	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	172
PID 4508 wrote to memory of 4436	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	940
PID 4508 wrote to memory of 5208	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	774
PID 4508 wrote to memory of 1200	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	178
PID 4508 wrote to memory of 5056	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1201
PID 4508 wrote to memory of 3116	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	602
PID 4508 wrote to memory of 5296	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	832
PID 4508 wrote to memory of 4104	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1335
PID 4508 wrote to memory of 5096	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	298
PID 4508 wrote to memory of 1308	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	191
PID 4508 wrote to memory of 3176	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1023
PID 4508 wrote to memory of 2212	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1053
PID 4508 wrote to memory of 5260	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1253
PID 4508 wrote to memory of 1988	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1112
PID 4508 wrote to memory of 5696	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	258
PID 4508 wrote to memory of 6120	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1048
PID 4508 wrote to memory of 5580	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	263
PID 4508 wrote to memory of 3484	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	207
PID 4508 wrote to memory of 5904	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	846
PID 4508 wrote to memory of 5940	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	443
PID 4508 wrote to memory of 2948	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1369
PID 4508 wrote to memory of 5976	4508	2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	1378

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d1dfd113c406902fbdc735dc54707f5e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' Get-PhysicalDisk | ForEach-Object { $c = $_ | Get-StorageReliabilityCounter [PSCustomObject]@{ DeviceId = [string]$_.DeviceId FriendlyName = [string]$_.FriendlyName SerialNumber = [string]$_.SerialNumber MediaType = [string]$_.MediaType BusType = [string]$_.BusType HealthStatus = [string]$_.HealthStatus OperationalStatus = (($_.OperationalStatus | ForEach-Object { [string]$_ }) -join ',') Size = $_.Size Temperature = $c.Temperature Wear = $c.Wear PowerOnHours = $c.PowerOnHours StartStopCycles = $c.StartStopCycles ReadErrorsTotal = $c.ReadErrorsTotal WriteErrorsTotal = $c.WriteErrorsTotal } } | ConvertTo-Json -Compress -Depth 6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\system32\powercfg.exe
  powercfg /list
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\Root | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  - Modifies registry key
  PID:3256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  PID:2156
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  2⤵
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
  2⤵
  PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\CA | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
  2⤵
  PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\TrustedPublisher | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\RemoteDesktop | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\WebHosting | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\system32\netstat.exe
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\My | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $profiles = Get-NetConnectionProfile -ErrorAction SilentlyContinue | Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity ConvertTo-Json $profiles -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\Root | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\CA | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$PSVersionTable | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5360
- C:\Windows\system32\netsh.exe
  netsh winhttp show proxy
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5944
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
  2⤵
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ExecutionPolicy -List | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:4748
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride
  2⤵
  PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $teams = Get-NetLbfoTeam -ErrorAction SilentlyContinue | Select-Object Name, TeamMembers, TeamingMode, LoadBalancingAlgorithm, Status if ($teams) { ConvertTo-Json $teams -Compress } else { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Test-WSMan -ErrorAction SilentlyContinue; $?"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:2848
- C:\Windows\system32\w32tm.exe
  w32tm /query /status
  2⤵
  PID:4852
- C:\Windows\system32\sc.exe
  sc query w32time
  2⤵
  - Launches sc.exe
  PID:6128
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters /v Type
  2⤵
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterRdma | Select-Object Name, Enabled $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterSriov | Select-Object Name, Enabled, NumVFs $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Module -ListAvailable | Select-Object Name,Version,Path | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterRss | Select-Object Name, Enabled, NumberOfReceiveQueues, MaxProcessorCount $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $props = Get-NetAdapterAdvancedProperty -AllProperties | Where-Object { $_.DisplayName -match 'Offload|ChecksumOffload|LsoV2|RscIPv4|RSC|RSS|VMQ|EncapsulatedTask|PacketCoalescing' } | Group-Object -Property Name $result = foreach ($g in $props) { $adp = $g.Group | Select-Object -First 1 [PSCustomObject]@{ Name = $adp.Name Offloads = @{} } foreach ($p in $g.Group) { $result_off = $p.DisplayName $result.Offloads[$result_off] = $p.DisplayValue } $result } $null = $result Get-NetAdapter | Select-Object Name, OffloadCapabilities, LsoV2IPv4, RscIPv4, EncapsulatedPacketTaskOffload, Rss, Vmq, PacketCoalescing | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4496
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $errPref = $ErrorActionPreference $ErrorActionPreference = 'SilentlyContinue' try { $samples = (Get-Counter -Counter @(\"\Processor(_Total)\% Processor Time\",\"\Memory\% Committed Bytes In Use\",\"\Memory\Available MBytes\",\"\PhysicalDisk(_Total)\Disk Reads/sec\",\"\PhysicalDisk(_Total)\Disk Writes/sec\",\"\PhysicalDisk(_Total)\% Disk Time\",\"\System\Processor Queue Length\",\"\System\Interrupts/sec\",\"\Paging File(_Total)\% Usage\",\"\Network Interface(*)\Bytes Received/sec\",\"\Network Interface(*)\Bytes Sent/sec\") -MaxSamples 1 -ErrorAction SilentlyContinue).CounterSamples $out = @() foreach ($s in $samples) { $out += [PSCustomObject]@{ Path = $s.Path; Value = $s.CookedValue } } ConvertTo-Json $out -Compress } catch { Write-Output '[]' } $ErrorActionPreference = $errPref "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  - Modifies registry key
  PID:2356
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion
  2⤵
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $apps = Get-AppxPackage | Select-Object Name, PackageFullName, Version, Publisher, InstallLocation, IsFramework ConvertTo-Json $apps -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Mozilla\Mozilla Firefox" /v CurrentVersion
  2⤵
  PID:5208
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /v DisplayVersion
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5056
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Opera /v DisplayVersion
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brave /v DisplayVersion
  2⤵
  PID:5296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Brave /v DisplayVersion
  2⤵
  PID:4104
- C:\Windows\system32\cmd.exe
  cmd /c assoc http
  2⤵
  - Executes a command shell one-liner
  PID:5096
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Python\PythonCore /v Version
  2⤵
  - Modifies registry key
  PID:1308
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Python\PythonCore /v Version
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Node.js /v Version
  2⤵
  - Modifies registry key
  PID:2212
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Node.js /v Version
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JavaSoft\Java Development Kit" /v CurrentVersion
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TeamViewer /s
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\TeamViewer /s
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JavaSoft\Java Runtime Environment" /v CurrentVersion
  2⤵
  PID:5580
- C:\Windows\system32\sc.exe
  sc query TeamViewer
  2⤵
  - Launches sc.exe
  PID:3484
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JavaSoft\Java Development Kit" /v CurrentVersion
  2⤵
  PID:5904
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq TeamViewer.exe"
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment" /v CurrentVersion
  2⤵
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $sdks = Get-ChildItem -Path \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -Recurse -ErrorAction SilentlyContinue | Get-ItemProperty -Name Version -ErrorAction SilentlyContinue | Where-Object { $_.Version } | Select-Object -ExpandProperty Version -Unique if ($sdks) { $sdks -join \",\" } else { \"\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5976
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq TeamViewer_Service.exe"
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\AnyDesk /s
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\AnyDesk /s
  2⤵
  - Modifies registry key
  PID:6004
- C:\Windows\system32\sc.exe
  sc query AnyDesk
  2⤵
  - Launches sc.exe
  PID:4868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2256
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq AnyDesk.exe"
  2⤵
  PID:2560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType System -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1692
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Google\Chrome Remote Desktop" /s
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Google\Chrome Remote Desktop" /s
  2⤵
  PID:1292
- C:\Windows\system32\sc.exe
  sc query remoting_host
  2⤵
  - Launches sc.exe
  PID:1068
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq remote_desktop.exe"
  2⤵
  PID:4860
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Splashtop Inc." /s
  2⤵
  PID:1488
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Splashtop Inc." /s
  2⤵
  PID:624
- C:\Windows\system32\sc.exe
  sc query SplashtopRemoteService
  2⤵
  PID:2192
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SRManager.exe"
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\RealVNC /s
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\RealVNC /s
  2⤵
  PID:2076
- C:\Windows\system32\sc.exe
  sc query vncserver
  2⤵
  - Launches sc.exe
  PID:6128
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vncserver.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3176
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\UltraVNC /s
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\UltraVNC /s
  2⤵
  - Modifies registry key
  PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType User -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4684
- C:\Windows\system32\sc.exe
  sc query uvnc_service
  2⤵
  - Launches sc.exe
  PID:4560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5580
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vncviewer.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4884
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq winvnc.exe"
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TightVNC /s
  2⤵
  PID:4364
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\TightVNC /s
  2⤵
  PID:4844
- C:\Windows\system32\sc.exe
  sc query tvnserver
  2⤵
  - Launches sc.exe
  PID:2312
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq tvnserver.exe"
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\RDP Wrapper" /s
  2⤵
  PID:2200
- C:\Windows\system32\sc.exe
  sc query TermService
  2⤵
  - Launches sc.exe
  PID:2524
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RDPCheck.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2044
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RDPWInst.exe"
  2⤵
  PID:5792
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\LogMeIn /s
  2⤵
  PID:5148
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\LogMeIn /s
  2⤵
  PID:2452
- C:\Windows\system32\sc.exe
  sc query LogMeIn
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq LogMeIn.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType File -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3240
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\ScreenConnect /s
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\ScreenConnect /s
  2⤵
  - Modifies registry key
  PID:1560
- C:\Windows\system32\sc.exe
  sc query "ScreenConnect Client"
  2⤵
  - Launches sc.exe
  PID:5096
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq ScreenConnect.ClientService.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:6128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Ammyy /s
  2⤵
  PID:1040
- C:\Windows\system32\sc.exe
  sc query AmmyyAdmin
  2⤵
  PID:3004
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq AA_v3.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\RustDesk /s
  2⤵
  - Modifies registry key
  PID:4816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\RustDesk /s
  2⤵
  - Modifies registry key
  PID:2864
- C:\Windows\system32\sc.exe
  sc query RustDesk
  2⤵
  - Launches sc.exe
  PID:1992
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq rustdesk.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Zabbix /s
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Zabbix /s
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Veeam\Veeam Backup and Replication" /s
  2⤵
  PID:4724
- C:\Windows\system32\sc.exe
  sc query "Zabbix Agent"
  2⤵
  - Launches sc.exe
  PID:3304
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq zabbix_agentd.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:6004
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Veeam\Veeam Backup and Replication" /s
  2⤵
  PID:2280
- C:\Windows\system32\sc.exe
  sc query VeeamBackupSvc
  2⤵
  - Launches sc.exe
  PID:2724
- C:\Windows\system32\sc.exe
  sc query VeeamBrokerSvc
  2⤵
  PID:2624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3320
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\InfluxData\Telegraf /s
  2⤵
  - Modifies registry key
  PID:5944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4640
- C:\Windows\system32\sc.exe
  sc query VeeamMountSvc
  2⤵
  - Launches sc.exe
  PID:5632
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\InfluxData\Telegraf /s
  2⤵
  PID:4992
- C:\Windows\system32\sc.exe
  sc query VeeamDeploySvc
  2⤵
  PID:2496
- C:\Windows\system32\sc.exe
  sc query telegraf
  2⤵
  PID:2184
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Veeam.Backup.Service.exe"
  2⤵
  PID:3620
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq telegraf.exe"
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Acronis\BackupAndRecovery /s
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Prometheus\Node Exporter" /s
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Acronis\BackupAndRecovery /s
  2⤵
  PID:260
- C:\Windows\system32\sc.exe
  sc query prometheus-node-exporter
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\system32\sc.exe
  sc query AcronisAgent
  2⤵
  - Launches sc.exe
  PID:4240
- C:\Windows\system32\sc.exe
  sc query AcronisService
  2⤵
  - Launches sc.exe
  PID:2620
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq node_exporter.exe"
  2⤵
  PID:1504
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mms.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3064
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Datadog\Datadog Agent" /s
  2⤵
  PID:476
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq acronis_agent.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:6048
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Datadog\Datadog Agent" /s
  2⤵
  PID:5404
- C:\Windows\system32\sc.exe
  sc query datadog-agent
  2⤵
  PID:3344
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup /s
  2⤵
  PID:1988
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq agent.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3812
- C:\Windows\system32\sc.exe
  sc query wbengine
  2⤵
  - Launches sc.exe
  PID:3244
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq wbengine.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5496
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\NewRelic\Infrastructure Agent" /s
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Macrium\Reflect /s
  2⤵
  - Modifies registry key
  PID:3132
- C:\Windows\system32\sc.exe
  sc query newrelic-infra
  2⤵
  - Launches sc.exe
  PID:808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Macrium\Reflect /s
  2⤵
  PID:1984
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq newrelic-infra.exe"
  2⤵
  PID:5924
- C:\Windows\system32\sc.exe
  sc query ReflectService
  2⤵
  PID:5976
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Reflect.exe"
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\SolarWinds\Agent /s
  2⤵
  - Modifies registry key
  PID:6004
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\SolarWinds\Agent /s
  2⤵
  PID:1132
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Veritas\Backup Exec" /s
  2⤵
  PID:2560
- C:\Windows\system32\sc.exe
  sc query SolarWinds.Agent
  2⤵
  - Launches sc.exe
  PID:4856
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Veritas\Backup Exec" /s
  2⤵
  PID:5148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SolarWinds.AgentService.exe"
  2⤵
  PID:1772
- C:\Windows\system32\sc.exe
  sc query BackupExecDeviceMediaService
  2⤵
  PID:5208
- C:\Windows\system32\sc.exe
  sc query BackupExecRPCService
  2⤵
  - Launches sc.exe
  PID:5192
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq benetns.exe"
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Splunk\Universal Forwarder" /s
  2⤵
  PID:624
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Splunk\Universal Forwarder" /s
  2⤵
  PID:4812
- C:\Windows\system32\sc.exe
  sc query SplunkForwarder
  2⤵
  - Launches sc.exe
  PID:4900
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\CommVault Systems\Galaxy\Instance001" /s
  2⤵
  PID:1224
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq splunkd.exe"
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\CommVault Systems\Galaxy\Instance001" /s
  2⤵
  PID:4192
- C:\Windows\system32\sc.exe
  sc query GalaxyCommunicator
  2⤵
  - Launches sc.exe
  PID:4484
- C:\Windows\system32\sc.exe
  sc query GalaxyClient
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Microsoft Operations Manager" /s
  2⤵
  PID:4156
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cvd.exe"
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Microsoft Operations Manager" /s
  2⤵
  PID:5112
- C:\Windows\system32\sc.exe
  sc query HealthService
  2⤵
  - Launches sc.exe
  PID:4188
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Cobian Backup 11" /s
  2⤵
  PID:5152
- C:\Windows\system32\sc.exe
  sc query SystemCenterManagement
  2⤵
  - Launches sc.exe
  PID:3324
- C:\Windows\system32\sc.exe
  sc query CobianBackup11
  2⤵
  PID:3228
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq MonitoringHost.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:456
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cbEngine.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5940
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Nagios\NRPE /s
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Symantec\Symantec System Recovery" /s
  2⤵
  PID:3652
- C:\Windows\system32\sc.exe
  sc query NRPE
  2⤵
  - Launches sc.exe
  PID:5016
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Symantec\Symantec System Recovery" /s
  2⤵
  PID:6072
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nrpe.exe"
  2⤵
  PID:3980
- C:\Windows\system32\sc.exe
  sc query VProSvc
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\system32\sc.exe
  sc query VProRecovery
  2⤵
  - Launches sc.exe
  PID:4436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Grafana\Agent /s
  2⤵
  - Modifies registry key
  PID:2184
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vprosvc.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4892
- C:\Windows\system32\sc.exe
  sc query "Grafana Agent"
  2⤵
  PID:5208
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq agent-windows-amd64.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2640
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Legato\NetWorker /s
  2⤵
  - Modifies registry key
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Legato\NetWorker /s
  2⤵
  PID:4688
- C:\Windows\system32\sc.exe
  sc query nsrexecd
  2⤵
  - Launches sc.exe
  PID:2732
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Amazon\SSM /s
  2⤵
  - Modifies registry key
  PID:2620
- C:\Windows\system32\sc.exe
  sc query nsrd
  2⤵
  - Launches sc.exe
  PID:5300
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Amazon\SSM /s
  2⤵
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nsrexecd.exe"
  2⤵
  PID:2348
- C:\Windows\system32\sc.exe
  sc query AmazonSSMAgent
  2⤵
  PID:5036
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq ssm-agent-worker.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2396
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\IBM\ADSM\CurrentVersion\BackupClient /s
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\IBM\ADSM\CurrentVersion\BackupClient /s
  2⤵
  - Modifies registry key
  PID:4328
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Azure Arc" /s
  2⤵
  PID:5784
- C:\Windows\system32\sc.exe
  sc query "TSM Scheduler"
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  sc query himds
  2⤵
  - Launches sc.exe
  PID:4188
- C:\Windows\system32\sc.exe
  sc query "TSM Client Acceptor"
  2⤵
  - Launches sc.exe
  PID:4560
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq azcmagent.exe"
  2⤵
  PID:3816
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq dsmcsvc.exe"
  2⤵
  PID:5244
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeePassPasswordSafe2_is1 /v DisplayVersion
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\KeePassPasswordSafe2_is1 /v DisplayVersion
  2⤵
  PID:4480
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq KeePass.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3652
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeePassXC /v DisplayVersion
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\KeePassXC /v DisplayVersion
  2⤵
  PID:344
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq KeePassXC.exe"
  2⤵
  PID:5312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1Password /v DisplayVersion
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1Password /v DisplayVersion
  2⤵
  PID:1488
- C:\Windows\system32\sc.exe
  sc query 1Password
  2⤵
  - Launches sc.exe
  PID:2116
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq 1Password.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2452
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bitwarden /v DisplayVersion
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bitwarden /v DisplayVersion
  2⤵
  PID:5296
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Bitwarden.exe"
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\OneDrive /v Version
  2⤵
  - Modifies registry key
  PID:2732
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dashlane /v DisplayVersion
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\OneDrive /v Version
  2⤵
  - Modifies registry key
  PID:2848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Dashlane /v DisplayVersion
  2⤵
  PID:2484
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\OneDrive /v Version
  2⤵
  - Modifies registry key
  PID:1692
- C:\Windows\system32\sc.exe
  sc query DashlaneService
  2⤵
  - Launches sc.exe
  PID:2284
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq OneDrive.exe"
  2⤵
  PID:2716
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Dashlane.exe"
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LastPass /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dropbox /v DisplayVersion
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LastPass /v DisplayVersion
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Dropbox /v DisplayVersion
  2⤵
  PID:5472
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq lastpass.exe"
  2⤵
  PID:2316
- C:\Windows\system32\sc.exe
  sc query DbxSvc
  2⤵
  - Launches sc.exe
  PID:456
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Dropbox.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2216
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RoboForm /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RoboForm /v DisplayVersion
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Drive" /v DisplayVersion
  2⤵
  PID:5924
- C:\Windows\system32\sc.exe
  sc query RoboFormService
  2⤵
  - Launches sc.exe
  PID:2312
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Drive" /v DisplayVersion
  2⤵
  PID:5500
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq robotaskbaricon.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4284
- C:\Windows\system32\sc.exe
  sc query GoogleDriveFS
  2⤵
  - Launches sc.exe
  PID:3980
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NordPass /v DisplayVersion
  2⤵
  PID:5148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GoogleDriveFS.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2016
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NordPass /v DisplayVersion
  2⤵
  PID:5208
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq NordPass.exe"
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Box Drive" /v DisplayVersion
  2⤵
  PID:2452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Box Drive" /v DisplayVersion
  2⤵
  PID:1152
- C:\Windows\system32\sc.exe
  sc query BoxDrive
  2⤵
  - Launches sc.exe
  PID:5224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4884
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BoxDrive.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2036
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2620
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MEGAsync /v DisplayVersion
  2⤵
  PID:4940
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Teams.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1492
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MEGAsync /v DisplayVersion
  2⤵
  PID:2948
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq MEGAsync.exe"
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zoom /v DisplayVersion
  2⤵
  PID:5152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nextcloud /v DisplayVersion
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Zoom /v DisplayVersion
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nextcloud /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:3240
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Zoom.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4868
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nextcloud.exe"
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Server" /v DisplayVersion
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Server" /v DisplayVersion
  2⤵
  PID:5924
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Synology Drive Client" /v DisplayVersion
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Skype /v DisplayVersion
  2⤵
  PID:4352
- C:\Windows\system32\sc.exe
  sc query PlexService
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Skype /v DisplayVersion
  2⤵
  PID:3980
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Synology Drive Client" /v DisplayVersion
  2⤵
  PID:616
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Plex Media Server.exe"
  2⤵
  PID:2624
- C:\Windows\system32\sc.exe
  sc query SynologyDriveService
  2⤵
  - Launches sc.exe
  PID:3256
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Skype.exe"
  2⤵
  PID:6120
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SynologyDrive.exe"
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jellyfin /v DisplayVersion
  2⤵
  PID:5280
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Slack /v DisplayVersion
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Jellyfin /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2620
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync" /v DisplayVersion
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Slack /v DisplayVersion
  2⤵
  PID:1432
- C:\Windows\system32\sc.exe
  sc query Jellyfin
  2⤵
  - Launches sc.exe
  PID:1288
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync" /v DisplayVersion
  2⤵
  PID:4852
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq jellyfin.exe"
  2⤵
  PID:2348
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq slack.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1388
- C:\Windows\system32\sc.exe
  sc query ResilioSync
  2⤵
  - Launches sc.exe
  PID:3340
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Resilio Sync.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5112
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Discord /v DisplayVersion
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Emby Server" /v DisplayVersion
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Emby Server" /v DisplayVersion
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Discord /v DisplayVersion
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pCloud Drive" /v DisplayVersion
  2⤵
  PID:4104
- C:\Windows\system32\sc.exe
  sc query EmbyServer
  2⤵
  - Launches sc.exe
  PID:2120
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Discord.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2312
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\pCloud Drive" /v DisplayVersion
  2⤵
  PID:4868
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EmbyServer.exe"
  2⤵
  PID:4352
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pCloud.exe"
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webex /v DisplayVersion
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kodi /v DisplayVersion
  2⤵
  PID:3788
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Webex /v DisplayVersion
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Kodi /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2076
- C:\Windows\system32\sc.exe
  sc query webexservice
  2⤵
  - Launches sc.exe
  PID:900
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq kodi.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1280
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Webex.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5904
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player" /v DisplayVersion
  2⤵
  PID:1288
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq uTorrent.exe"
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoToMeeting /v DisplayVersion
  2⤵
  PID:3400
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\GoToMeeting /v DisplayVersion
  2⤵
  PID:4660
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vlc.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4524
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrent /v DisplayVersion
  2⤵
  PID:364
- C:\Windows\system32\sc.exe
  sc query "GoToMeeting Service"
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrent /v DisplayVersion
  2⤵
  PID:5840
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq g2mcomm.exe"
  2⤵
  PID:2552
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BitTorrent.exe"
  2⤵
  PID:1068
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify /v DisplayVersion
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spotify /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2424
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cisco Jabber" /v DisplayVersion
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qBittorrent /v DisplayVersion
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Cisco Jabber" /v DisplayVersion
  2⤵
  PID:1392
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Spotify.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:468
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\qBittorrent /v DisplayVersion
  2⤵
  PID:3256
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq CiscoJabber.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3952
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qbittorrent.exe"
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iTunes /v DisplayVersion
  2⤵
  PID:3420
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iTunes /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4220
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RingCentral /v DisplayVersion
  2⤵
  PID:932
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Deluge /v DisplayVersion
  2⤵
  PID:1040
- C:\Windows\system32\sc.exe
  sc query AppleMobileDeviceService
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RingCentral /v DisplayVersion
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Deluge /v DisplayVersion
  2⤵
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq iTunes.exe"
  2⤵
  PID:4988
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RingCentral.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2396
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq deluge.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1688
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Telegram Desktop" /v DisplayVersion
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Media Player" /v DisplayVersion
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Telegram Desktop" /v DisplayVersion
  2⤵
  PID:5472
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq wmplayer.exe"
  2⤵
  PID:3228
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq deluged.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5840
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Telegram.exe"
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Player" /v DisplayVersion
  2⤵
  PID:2524
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Transmission /v DisplayVersion
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Player" /v DisplayVersion
  2⤵
  PID:6012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5208
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Transmission /v DisplayVersion
  2⤵
  PID:2680
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Plex Media Player.exe"
  2⤵
  PID:2116
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq transmission-qt.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3972
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq transmission-daemon.exe"
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v DisplayVersion
  2⤵
  PID:5148
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v DisplayVersion
  2⤵
  PID:256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vuze /v DisplayVersion
  2⤵
  PID:5056
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq steam.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5276
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Vuze /v DisplayVersion
  2⤵
  PID:4360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2848
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Azureus.exe"
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v DisplayVersion
  2⤵
  PID:1280
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v DisplayVersion
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tixati /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1288
- C:\Windows\system32\sc.exe
  sc query EpicOnlineServices
  2⤵
  PID:3340
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Tixati /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1144
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EpicGamesLauncher.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $exchange = Get-ExchangeServer -Identity $env:COMPUTERNAME -ErrorAction SilentlyContinue | Select-Object Name, Edition, AdminDisplayVersion, ServerRole, Site if ($exchange) { $org = Get-OrganizationConfig -ErrorAction SilentlyContinue | Select-Object Name $out = [PSCustomObject]@{ Name = $exchange.Name Edition = $exchange.Edition Version = ($exchange.AdminDisplayVersion -replace 'Version ','') ServerRole = $exchange.ServerRole.ToString() OrganizationName = $org.Name } ConvertTo-Json $out -Compress } else { Write-Output '{}' } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5496
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Tixati.exe"
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GOG Galaxy" /v DisplayVersion
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\GOG Galaxy" /v DisplayVersion
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\PostgreSQL Global Development Group\PostgreSQL" /s
  2⤵
  PID:3172
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GalaxyClient.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3648
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\PostgreSQL Global Development Group\PostgreSQL" /s
  2⤵
  PID:2424
- C:\Windows\system32\sc.exe
  sc query postgresql-x64-
  2⤵
  - Launches sc.exe
  PID:616
- C:\Windows\system32\sc.exe
  sc query postgresql-x86-
  2⤵
  PID:900
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EA App" /v DisplayVersion
  2⤵
  PID:1756
- C:\Windows\system32\cmd.exe
  cmd /c "sc query | findstr postgresql"
  2⤵
  - Executes a command shell one-liner
  PID:4688
- - C:\Windows\system32\sc.exe
    sc query
    3⤵
    - Launches sc.exe
    PID:5036
- - C:\Windows\system32\findstr.exe
    findstr postgresql
    3⤵
    PID:5296
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EA App" /v DisplayVersion
  2⤵
  PID:5604
- C:\Windows\system32\sc.exe
  sc query EABackgroundService
  2⤵
  - Launches sc.exe
  PID:3788
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq postgres.exe"
  2⤵
  PID:2076
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EADesktop.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5260
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\MySQL AB\MySQL Server" /s
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Origin /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2612
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\MySQL AB\MySQL Server" /s
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Origin /v DisplayVersion
  2⤵
  PID:3624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5904
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\MySQL\MySQL Server" /s
  2⤵
  PID:4192
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Origin.exe"
  2⤵
  PID:3244
- C:\Windows\system32\sc.exe
  sc query MySQL
  2⤵
  - Launches sc.exe
  PID:824
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mysqld.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:364
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Battle.net /v DisplayVersion
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Battle.net /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' try { $points = Get-ComputerRestorePoint -ErrorAction SilentlyContinue | Select-Object Description, RestorePointType, @{Name='Date'; Expression={$_.ConvertToDateTime($_.CreationTime)}}, SequenceNumber if ($points) { $points | ConvertTo-Json -Compress } else { Write-Output '[]' } } catch { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3692
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\MariaDB /s
  2⤵
  PID:2948
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Battle.net.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1428
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\MariaDB /s
  2⤵
  PID:2312
- C:\Windows\system32\sc.exe
  sc query MariaDB
  2⤵
  - Launches sc.exe
  PID:2728
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ubisoft Connect" /v DisplayVersion
  2⤵
  PID:1392
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mysqld.exe"
  2⤵
  PID:900
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Ubisoft Connect" /v DisplayVersion
  2⤵
  PID:360
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Upc.exe"
  2⤵
  PID:5036
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mariadbd.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1908
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XboxApp /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4344
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\MongoDB /s
  2⤵
  PID:2488
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq XboxApp.exe"
  2⤵
  PID:4620
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\MongoDB /s
  2⤵
  PID:3268
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GameBar.exe"
  2⤵
  PID:4676
- C:\Windows\system32\sc.exe
  sc query MongoDB
  2⤵
  - Launches sc.exe
  PID:1124
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mongod.exe"
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rockstar Games Launcher" /v DisplayVersion
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rockstar Games Launcher" /v DisplayVersion
  2⤵
  PID:2708
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Redis /s
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Redis /s
  2⤵
  PID:5976
- C:\Windows\system32\sc.exe
  sc query RockstarService
  2⤵
  - Launches sc.exe
  PID:5440
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpType
  2⤵
  PID:2328
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Launcher.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1076
- C:\Windows\system32\sc.exe
  sc query Redis
  2⤵
  - Launches sc.exe
  PID:2936
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq redis-server.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2728
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpFolder
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpCount
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bethesda.net Launcher" /v DisplayVersion
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Oracle /s
  2⤵
  - Modifies registry key
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $events = Get-WinEvent -FilterHashtable @{LogName='Application'; ID=1000; Level=2} -MaxEvents 5 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message $out = @() foreach ($e in $events) { $out += \"$($e.TimeCreated): $($e.Message -replace '\r|\n', ' ')\" } if ($out) { $out -join \"\n\" } else { \"\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:1984
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bethesda.net Launcher" /v DisplayVersion
  2⤵
  PID:2156
- C:\Windows\system32\sc.exe
  sc query OracleService
  2⤵
  - Launches sc.exe
  PID:1504
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BethesdaLauncher.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4872
- C:\Windows\system32\sc.exe
  sc query OracleOraDB
  2⤵
  - Launches sc.exe
  PID:2912
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq oracle.exe"
  2⤵
  PID:3408
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq tnslsnr.exe"
  2⤵
  PID:5072
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SQLite /s
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\VisualStudio\Setup\InstalledProducts /v Version
  2⤵
  - Modifies registry key
  PID:1580
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CockroachDB /s
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\Setup\InstalledProducts /v Version
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CockroachDB /s
  2⤵
  PID:364
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq devenv.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2708
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cockroach.exe"
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA457B21-F73E-494C-ACAB-524FDE97-0000} /v DisplayVersion
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Firebird Project\Firebird Server" /s
  2⤵
  PID:6128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{EA457B21-F73E-494C-ACAB-524FDE97-0000} /v DisplayVersion
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Firebird Project\Firebird Server" /s
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1 /v DisplayVersion
  2⤵
  PID:4680
- C:\Windows\system32\sc.exe
  sc query FirebirdServer
  2⤵
  - Launches sc.exe
  PID:3004
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Code.exe"
  2⤵
  PID:2584
- C:\Windows\system32\sc.exe
  sc query FirebirdGuardian
  2⤵
  PID:5148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq fbserver.exe"
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JetBrains\IntelliJ IDEA" /v Version
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JetBrains\IntelliJ IDEA" /v Version
  2⤵
  PID:4904
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq fbguard.exe"
  2⤵
  PID:4996
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq idea64.exe"
  2⤵
  PID:2808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Couchbase\Server /s
  2⤵
  - Modifies registry key
  PID:1100
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq idea.exe"
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Couchbase\Server /s
  2⤵
  - Modifies registry key
  PID:1396
- C:\Windows\system32\sc.exe
  sc query CouchbaseServer
  2⤵
  - Launches sc.exe
  PID:4856
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\PyCharm /v Version
  2⤵
  PID:5068
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq erl.exe"
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\PyCharm /v Version
  2⤵
  - Modifies registry key
  PID:3328
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pycharm64.exe"
  2⤵
  PID:5384
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Workstation" /v ProductVersion
  2⤵
  PID:4908
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pycharm.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5548
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Workstation" /v ProductVersion
  2⤵
  PID:3652
- C:\Windows\system32\sc.exe
  sc query VMwareWorkstationServer
  2⤵
  PID:4128
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmware-vmx.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1756
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\WebStorm /v Version
  2⤵
  - Modifies registry key
  PID:2936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\WebStorm /v Version
  2⤵
  PID:5192
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq webstorm64.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Player" /v ProductVersion
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Player" /v ProductVersion
  2⤵
  PID:5480
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq webstorm.exe"
  2⤵
  PID:4548
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmplayer.exe"
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\PhpStorm /v Version
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Oracle\VirtualBox /v Version
  2⤵
  - Modifies registry key
  PID:4432
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\PhpStorm /v Version
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Oracle\VirtualBox /v Version
  2⤵
  PID:1432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3176
- C:\Windows\system32\sc.exe
  sc query VBoxDrv
  2⤵
  - Launches sc.exe
  PID:6072
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq phpstorm64.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3408
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq VBoxSVC.exe"
  2⤵
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' Import-Module RemoteDesktop -ErrorAction SilentlyContinue $rdsh = Get-RDServer -ErrorAction SilentlyContinue $broker = Get-RDConnectionBrokerHighAvailability -ErrorAction SilentlyContinue if ($rdsh -or $broker) { $role = if ($broker) { 'ConnectionBroker' } else { 'SessionHost' } $out = [PSCustomObject]@{ Installed = $true; Role = $role } ConvertTo-Json $out -Compress } else { Write-Output '{\"Installed\":false}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5260
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq phpstorm.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4476
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq VirtualBoxVM.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3228
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\Rider /v Version
  2⤵
  - Modifies registry key
  PID:5440
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Parallels\Parallels Desktop" /v Version
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\Rider /v Version
  2⤵
  PID:616
- C:\Windows\system32\sc.exe
  sc query prl_disp_service
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq prl_cc.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3528
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq rider64.exe"
  2⤵
  PID:1132
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\QEMU /v Version
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\CLion /v Version
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\CLion /v Version
  2⤵
  PID:4240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5480
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\QEMU /v Version
  2⤵
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qemu-system-x86_64.exe"
  2⤵
  PID:2348
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq clion64.exe"
  2⤵
  PID:4900
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qemu.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2344
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eclipse IDE" /v DisplayVersion
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Eclipse IDE" /v DisplayVersion
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Docker Desktop" /v DisplayVersion
  2⤵
  PID:4524
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq eclipse.exe"
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Docker Desktop" /v DisplayVersion
  2⤵
  PID:3256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4748
- C:\Windows\system32\sc.exe
  sc query com.docker.service
  2⤵
  - Launches sc.exe
  PID:1224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetBeans /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4100
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Docker Desktop.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5968
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NetBeans /v DisplayVersion
  2⤵
  PID:4884
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR /s
  2⤵
  PID:3808
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq netbeans64.exe"
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Enum\USB /s
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft-Hyper-V-Management-PowerShell /v DisplayVersion
  2⤵
  PID:5548
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmcompute.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2076
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq netbeans.exe"
  2⤵
  PID:5420
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmms.exe"
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sublime Text" /v DisplayVersion
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Citrix\XenTools /v Version
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Sublime Text" /v DisplayVersion
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Citrix\XenTools /v Version
  2⤵
  - Modifies registry key
  PID:4344
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq sublime_text.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1040
- C:\Windows\system32\sc.exe
  sc query xenservice
  2⤵
  PID:4980
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq xenagent.exe"
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ /v DisplayVersion
  2⤵
  PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (1 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 1 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (2 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 2 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (3 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 3 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1812
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq notepad++.exe"
  2⤵
  PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (1 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 1 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (2 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 2 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (3 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 3 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Security' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $evts = Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2,3 } -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object LogName, Id, ProviderName, TimeCreated, LevelDisplayName, @{N='Message';E={(($_.Message -split \"`r?`n\")[0])}} $evts | ConvertTo-Json -Depth 2 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $evts = Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=1,2,3 } -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object LogName, Id, ProviderName, TimeCreated, LevelDisplayName, @{N='Message';E={(($_.Message -split \"`r?`n\")[0])}} $evts | ConvertTo-Json -Depth 2 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5044
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Atom /v DisplayVersion
  2⤵
  PID:5384
- C:\Windows\system32\secedit.exe
  secedit /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas SECURITYPOLICY
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Atom /v DisplayVersion
  2⤵
  PID:1704
- C:\Windows\system32\cmd.exe
  cmd /c type C:\Users\Admin\AppData\Local\Temp\secpol.cfg
  2⤵
  - Executes a command shell one-liner
  PID:360
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq atom.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5192
- C:\Windows\system32\auditpol.exe
  auditpol /get /category:*
  2⤵
  PID:616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' try { $pref = Get-MpPreference -ErrorAction SilentlyContinue if ($pref) { $out = [PSCustomObject]@{ ExclusionPath = $pref.ExclusionPath ExclusionExtension = $pref.ExclusionExtension ExclusionProcess = $pref.ExclusionProcess } ConvertTo-Json $out -Compress } else { Write-Output '{}' } } catch { Write-Output '{}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5604
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vim /v DisplayVersion
  2⤵
  PID:3972
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vim.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:5420
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq gvim.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1280
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Neovim /v DisplayVersion
  2⤵
  PID:3400
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nvim.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:720
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nvim-qt.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4192
- C:\Windows\system32\sc.exe
  sc query type= state= all
  2⤵
  - Launches sc.exe
  PID:4540
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Enrollments
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\MdmSubscriberIds" /v ""
  2⤵
  PID:3224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\AutoPilot\Enrollments /v TenantId
  2⤵
  - Modifies registry key
  PID:2924
- C:\Windows\system32\gpresult.exe
  gpresult /r
  2⤵
  PID:3980
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:5620
- C:\Windows\system32\manage-bde.exe
  manage-bde -protectors -get
  2⤵
  PID:700
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:4816
- C:\Windows\system32\manage-bde.exe
  manage-bde -status
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\BitLockerStatus /v OSVHDProtected
  2⤵
  - Modifies registry key
  PID:4644
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\BitLockerStatus /v OSVolumeProtected
  2⤵
  - Modifies registry key
  PID:344
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v EncryptionMethod
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPM
  2⤵
  - Modifies registry key
  PID:2948
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPMPIN
  2⤵
  - Modifies registry key
  PID:5152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPMStartupKey
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v MinimumPINLength
  2⤵
  PID:5364
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryKeyUsagePolicy
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryPasswordUsagePolicy
  2⤵
  PID:6012
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v HideRecoveryPage
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryURL
  2⤵
  PID:1096
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryMessage
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\FDV /v EncryptionMethod
  2⤵
  PID:5192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\RDV /v EncryptionMethod
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceGuard /v KernelDMAProtection
  2⤵
  PID:3304
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceGuard /v DeviceGuardDMAProtectionPolicy
  2⤵
  PID:4424
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v RequireSecuritySignature
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v EnableSecuritySignature
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v Smb1Enabled
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v EncryptData
  2⤵
  - Modifies registry key
  PID:4220
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v SmbServerNameHardeningLevel
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v RequireSecuritySignature
  2⤵
  - Modifies registry key
  PID:2016
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableSecuritySignature
  2⤵
  PID:1280
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableEncryption
  2⤵
  PID:2808
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v RequireEncryption
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableCompressedTraffic
  2⤵
  - Modifies registry key
  PID:4948
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryption
  2⤵
  PID:720
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v PortNumber
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v PortNumber
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel
  2⤵
  - Modifies registry key
  PID:2624
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NtlmMinClientSec
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NtlmMinServerSec
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 /v RestrictReceivingNTLMTraffic
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 /v RestrictSendingNTLMTraffic
  2⤵
  PID:3812
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters /v RestrictNTLMInDomain
  2⤵
  - Modifies registry key
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v SupportedEncryptionTypes
  2⤵
  - Modifies registry key
  PID:1776
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxClockSkew
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxTicketAge
  2⤵
  - Modifies registry key
  PID:476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxRenewAge
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxServiceTicketAge
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v RequireStrongKey
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v AllowBasic
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v AllowCredSSP
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v HTTPSRequired
  2⤵
  PID:3160
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4340
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v CertificateThumbprint
  2⤵
  PID:5016
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /v EnableScriptBlockLogging
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging /v EnableModuleLogging
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
  2⤵
  - Modifies registry key
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdminMode
  2⤵
  - Modifies registry key
  PID:3328
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LimitBlankPasswordUse
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NoLMHash
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate
  2⤵
  - Modifies registry key
  PID:2292
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v MaxSize
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v Retention
  2⤵
  - Modifies registry key
  PID:4644
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v File
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v File
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v CrashOnAuditFail
  2⤵
  PID:1304
- C:\Windows\system32\wsl.exe
  wsl -l -v
  2⤵
  PID:4884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4292
- C:\Windows\system32\wsl.exe
  wsl -l
  2⤵
  PID:5364
- C:\Windows\system32\wsl.exe
  wsl --version
  2⤵
  PID:4288
- C:\Windows\system32\qwinsta.exe
  qwinsta
  2⤵
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-SmbServerConfiguration -ErrorAction SilentlyContinue | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature, EncryptData, MaxConnectionsPerServer ConvertTo-Json $cfg -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-SmbClientConfiguration -ErrorAction SilentlyContinue | Select-Object RequireSecuritySignature, EnableInsecureGuestLogons, DisableCompression ConvertTo-Json $cfg -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $feats = Get-WindowsOptionalFeature -Online | Where-Object { $_.State -eq 'Enabled' } | Select-Object FeatureName, DisplayName, State ConvertTo-Json $feats -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2284
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {A9148703-6A14-404A-96F4-4981F88A8BA7}
    3⤵
    PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $feats = Get-WindowsFeature | Where-Object { $_.Installed -eq $true } | Select-Object Name, DisplayName, InstallState ConvertTo-Json $feats -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $shares = Get-SmbShare | Select-Object Name, Path, Description, EncryptData ConvertTo-Json $shares -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:248
- C:\Windows\system32\dism.exe
  dism /online /get-features /format:table
  2⤵
  PID:1888
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {D736EB71-1238-44EC-966B-A6D78386A51E}
    3⤵
    PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $conns = Get-VpnConnection -AllUserConnection -ErrorAction SilentlyContinue if (-not $conns) { $conns = Get-VpnConnection -ErrorAction SilentlyContinue } $out = foreach ($c in $conns) { [PSCustomObject]@{ Name = $c.Name ServerAddress = $c.ServerAddress ConnectionType = $c.VpnType.ToString() Status = $c.ConnectionStatus.ToString() Enabled = $c.IsProvisioned SplitTunneling = $c.SplitTunneling } } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6004
- C:\Windows\system32\sc.exe
  sc query WinRM
  2⤵
  - Launches sc.exe
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $listeners = winrm enumerate winrm/config/listener -format:xml 2>$null if ($listeners) { $xml = [xml]$listeners $out = foreach ($l in $xml.Listeners.Listener) { [PSCustomObject]@{ Address = ($l.Address | Select-Object -First 1) Transport = ($l.Transport | Select-Object -First 1) Port = [int]($l.Port | Select-Object -First 1) Enabled = ($l.Enabled | Select-Object -First 1) -eq 'true' } } ConvertTo-Json $out -Compress } else { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\winrm.cmd" enumerate winrm/config/listener -format:xml"
    3⤵
    - Executes a command shell one-liner
    PID:5012
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Windows\System32\winrm.vbs" enumerate winrm/config/listener -format:xml
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $shares = Get-SmbShare -ErrorAction SilentlyContinue $result = @() foreach ($share in $shares) { $access = Get-SmbShareAccess -Name $share.Name -ErrorAction SilentlyContinue foreach ($a in $access) { $result += [PSCustomObject]@{ ShareName = $share.Name Account = $a.AccountName AccessRight = $a.AccessRight AccessControlType = $a.AccessControlType } } } $result | ConvertTo-Json -Depth 3 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4788
- C:\Windows\system32\sc.exe
  sc query type= state=all
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist /s
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist /s
  2⤵
  - Modifies registry key
  PID:5508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $pref = Get-MpPreference -ErrorAction SilentlyContinue if ($pref) { $out = @() foreach ($rule in $pref.AttackSurfaceReductionRules_Ids) { $idx = [array]::IndexOf($pref.AttackSurfaceReductionRules_Ids, $rule) $action = $pref.AttackSurfaceReductionRules_Actions[$idx] $out += [PSCustomObject]@{ RuleId = $rule Action = $action } } $out | ConvertTo-Json -Depth 3 -Compress } else { \"\" } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4620
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v VendorIdentifier
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v FeatureSet
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v Identifier
  2⤵
  PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-Item WSMan:\localhost\MaxEnvelopeSizekb -ErrorAction SilentlyContinue if ($cfg) { $cfg.Value } else { 0 } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-MpPreference -ErrorAction SilentlyContinue).AttackSurfaceReductionOnlyConfigurations"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' Import-Module ActiveDirectory -ErrorAction SilentlyContinue $dc = Get-ADDomainController -Identity $env:COMPUTERNAME -ErrorAction SilentlyContinue if ($dc) { $forest = Get-ADForest -ErrorAction SilentlyContinue $out = [PSCustomObject]@{ IsDomainController = $true Domain = $dc.Domain Forest = $forest.Name Site = $dc.Site Roles = @($dc.OperationMasterRoles | ForEach-Object { $_.ToString() }) } ConvertTo-Json $out -Compress } else { Write-Output '{}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3352
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:1096
- C:\Windows\system32\cscript.exe
  cscript //Nologo C:\Windows\System32\slmgr.vbs /dlv
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $products = Get-WmiObject SoftwareLicensingProduct | Where-Object { $_.LicenseStatus -eq 1 -or $_.LicenseStatus -eq 0 } | Select-Object Name, ApplicationID, LicenseStatus, ProductKeyChannel, PartialProductKey ConvertTo-Json $products -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $sys = [System.Environment]::GetEnvironmentVariables('Machine') $user = [System.Environment]::GetEnvironmentVariables('User') $out = [PSCustomObject]@{ System = $sys.GetEnumerator() | ForEach-Object { [PSCustomObject]@{ Name = $_.Key; Value = $_.Value } } User = $user.GetEnumerator() | ForEach-Object { [PSCustomObject]@{ Name = $_.Key; Value = $_.Value } } } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:468
- C:\Windows\System32\Wbem\wmic.exe
  wmic qfe get HotFixID,Description,InstalledOn /format:csv
  2⤵
  PID:3320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $session = New-Object -ComObject Microsoft.Update.Session $searcher = $session.CreateUpdateSearcher() try { $result = $searcher.Search(\"IsInstalled=0 and Type='Software'\") $updates = @() foreach ($update in $result.Updates) { $obj = @{ Title = $update.Title; KB = ($update.KBArticleIDs -join ',') } $updates += $obj } $updates | ConvertTo-Json -Compress } catch { @{ Error = $_.Exception.Message } | ConvertTo-Json -Compress }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5784
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  PID:4620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2248
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP" /s
  2⤵
  PID:4284
- C:\Program Files\dotnet\dotnet.exe
  dotnet --list-runtimes
  2⤵
  - System Time Discovery
  PID:4424
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $locale = Get-WinSystemLocale $culture = Get-Culture $tz = Get-TimeZone $langs = Get-WinUserLanguageList | ForEach-Object { $_.LanguageTag } $kb = Get-WinUserLanguageList | ForEach-Object { $_.InputMethodTips } $out = [PSCustomObject]@{ SystemLocale = $locale.Name Culture = $culture.Name TimeZone = $tz.StandardName Languages = $langs Keyboards = $kb } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $paths = @( \"C:\Program Files\Microsoft Office\Office16\ospp.vbs\", \"C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs\", \"C:\Program Files\Microsoft Office\Office15\ospp.vbs\", \"C:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs\" ) foreach ($p in $paths) { if (Test-Path $p) { cscript //Nologo $p /dstatus break } } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:608
- - C:\Windows\system32\cscript.exe
    "C:\Windows\system32\cscript.exe" //Nologo "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
  2⤵
  - Modifies registry key
  PID:1892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot /v State
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
  2⤵
  PID:5224
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  PID:4432
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  PID:4948
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' $dll = 'C:\ProgramData\LibreHardwareMonitor\LibreHardwareMonitorLib.dll' try { [Reflection.Assembly]::LoadFrom($dll) | Out-Null } catch { Write-Output 'LOAD_FAIL'; exit 2 } $c = New-Object LibreHardwareMonitor.Hardware.Computer $c.IsCpuEnabled=$true $c.IsGpuEnabled=$true $c.IsMotherboardEnabled=$true $c.IsControllerEnabled=$true $c.IsStorageEnabled=$true $c.IsBatteryEnabled=$true $c.IsNetworkEnabled=$true try { $c.Open() } catch {} $out = New-Object System.Collections.ArrayList function Add-LhmSensors($hw) { try { $hw.Update() } catch {} foreach ($s in $hw.Sensors) { [void]$out.Add([PSCustomObject]@{ Hardware=[string]$hw.Name; HardwareType=[string]$hw.HardwareType; Name=[string]$s.Name; SensorType=[string]$s.SensorType; Identifier=[string]$s.Identifier; Value=$s.Value; Min=$s.Min; Max=$s.Max }) } foreach ($sub in $hw.SubHardware) { Add-LhmSensors $sub } } foreach ($hw in $c.Hardware) { Add-LhmSensors $hw } try { $c.Close() } catch {} $out | ConvertTo-Json -Compress -Depth 4 "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2948
- C:\Windows\system32\net.exe
  net accounts
  2⤵
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:1396
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v PasswordComplexity
  2⤵
  PID:4996
- C:\Windows\system32\auditpol.exe
  auditpol /get /category:*
  2⤵
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "ConvertTo-Json @(Get-Tpm)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2308
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' Get-PhysicalDisk | ForEach-Object { $c = $_ | Get-StorageReliabilityCounter [PSCustomObject]@{ DeviceId = [string]$_.DeviceId FriendlyName = [string]$_.FriendlyName SerialNumber = [string]$_.SerialNumber MediaType = [string]$_.MediaType BusType = [string]$_.BusType HealthStatus = [string]$_.HealthStatus OperationalStatus = (($_.OperationalStatus | ForEach-Object { [string]$_ }) -join ',') Size = $_.Size Temperature = $c.Temperature Wear = $c.Wear PowerOnHours = $c.PowerOnHours StartStopCycles = $c.StartStopCycles ReadErrorsTotal = $c.ReadErrorsTotal WriteErrorsTotal = $c.WriteErrorsTotal } } | ConvertTo-Json -Compress -Depth 6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2104

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Password Policy Discovery

T1201

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlackSharp.Core.dll

Path C:\ProgramData\LibreHardwareMonitor\BlackSharp.Core.dll
Size 32KB
SHA256 cafb93afcc8d8a367e21f619673d05c06887d8964867fed1371f02ded1cd3e23
MD5 af10d830d9dadf30fe9135802c2c2b3a
SHA1 f8481a61aaa04eea57834f549118f3d31039fb00
SHA512 0baed44567ed36e801abb52f0e79c4ded943fb13b8d9a20148f33fdc2c40ec691238fd254d136bda673d6041d03a406f0c0a8747f57e30930c3661f9414864ec
SSDEEP 768:3c4f44voYXoCA1lPKLXSIptrxH7iryQgbmefLPGdGD0I7riiD:bvoBL1lPEXSe1xGgbm2+d8PD
TLSH
T188E26B02A3C88733DBAE46B8F8F112614B72C762B563F71779C8A5EA4D537154A123F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskInfoToolkit.dll

Path C:\ProgramData\LibreHardwareMonitor\DiskInfoToolkit.dll
Size 882KB
SHA256 1acbf51b3c10c51c986cf43021680d34a2e38d9a5ba652bcfa9a1b5f7fc09800
MD5 0485939203a30164063ae25e10b8315d
SHA1 d9a34d47df2e7bab2cd7ea12c054b761d918f9e2
SHA512 b90a216d43a0198765942b27db36b6f933061d9da24b44bdc4d097e82c162619a2906ef51676d5d4f95ffdd7f50489a4ed9b15669a2ce59c030a00339a30df80
SSDEEP 12288:bGB1zTwxF4Nd8FmqqNASPciHXE/ywo1MsCgqivn72Gt6rFI4nLo4v:bGBxwxF4Nd8wVNAYX3u4Mxmmq4nLok
TLSH
T12E15BFB443A92D23F6AF1FF288A350404AF2B02E5637D78DCDD5D8DD98A9DD06818727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HidSharp.dll

Path C:\ProgramData\LibreHardwareMonitor\HidSharp.dll
Size 256KB
SHA256 d86690efde30ea9179f669320f39148853793b743a98b531afeaf30598e22f54
MD5 3876a747858ca11995f25a8a4a8db104
SHA1 4094d7e274f9d87d8c93f3a8aa14606dbf3994d8
SHA512 c67545f6ca74dc59690e12b00a8c0ddb848926c414f8d8af14a2290f5ed647a481542f90c7b47522c1ba32116ebd3f16a49315a86c8a8d7508759ab7335add78
SSDEEP 3072:E1lZKoJKw/ATXA2okJSY4tvmWB7pbDXQrKsbiffsv0JKdyxCCqIZ2nyreCoe+:ERJ+TXA2okMjv3BlYKYAs8iyXWyCCoe+
TLSH
T13C448D0D5BEC862FDDEF4735B43298148BF1E495A212E7AE15ACD4EA1C937C089413E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibreHardwareMonitorLib.dll

Path C:\ProgramData\LibreHardwareMonitor\LibreHardwareMonitorLib.dll
Size 1.1MB
SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
MD5 ecc49bd21fc187ba1a39b2f84bcfb9af
SHA1 eea8552e5ed715ffa6882a2c6335d4c1f9fe5ea9
SHA512 34573db40fa4482953146e852015d3a802cac263aa78910cb33f0aee271e2412494a4a6c219c785f6c7696d3fab0f79d2b257b69c5ba7b62fb424e473ec7e03a
SSDEEP 12288:oULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy7:oWSktWpw/lgdm
TLSH
T1C645290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIOLib.dll

Path C:\ProgramData\PawnIO\PawnIOLib.dll
Size 38KB
SHA256 d71f62627d66983bb9f5b1c269f27bcd8c1b8a46e794377a6330f84c198f4443
MD5 ab63195d7f5d470d39284cbee5bd57f7
SHA1 f438797c5724e7142264697072f6ae7f161dabc6
SHA512 9c007911a6ee4c800a98883ee44de1dc78a879048c93b415d114f3095d386fa83fb5d10edda0e025e0b821612c528444b136b40e35a6ca8aaa508bb373e702ed
SSDEEP 384:kmbKFNL+YuMHvWcbAPZr0YLShbjdAA1m5wMPU5uEuo+:krFNLic+cbgfShbxf1mlP5EB+
TLSH
T1A4037C9B8104528BEDA7DEB482CBDA1FBC3877432B6105EBA1D9C0581D41BC5B33667A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download