cc8930c6d276861df09b446b630330c4e12b4aef37472969dfb6d42a34eeb710

Analysis

max time kernel
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe
Size 2.4MB
Sample260810-cdc7fshj8y
SHA256 cc8930c6d276861df09b446b630330c4e12b4aef37472969dfb6d42a34eeb710
MD5 c5005438d277cbe62b07d52f7b117ef4
SHA1 6c53fcb7b402e24e2730dda14dc0ae01bc4d2e8d
SHA512 7b88a376839f7e8cb1c498270d9aaab3c240bb5e2fa66ae2097f9b7a6da978052dbbf879500e1a0446bd40e6a600b4bdb71e7c2aaa88e3355938ab6f6fa1b5ce
SSDEEP 49152:RNRs9nqcFWH/61Pvxzn2XriM+Ki44XnWhX0JG:9DB6NgTthEJG
TLSH
T12BC5F8591A532E6CE557A0729599320BB7A4FD1D03F2769788E9082C5B532CC83FFF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5432	powershell.exe
2780	powershell.exe
1384	powershell.exe
5876	powershell.exe
4236	powershell.exe
548	powershell.exe
1576	powershell.exe
5840	powershell.exe
936	powershell.exe
3780	powershell.exe
568	powershell.exe
5396	powershell.exe
2524	powershell.exe
5552	powershell.exe
3224	powershell.exe
5860	powershell.exe
1844	powershell.exe
4912	powershell.exe
704	powershell.exe
752	powershell.exe
5064	powershell.exe
3860	powershell.exe
3772	powershell.exe
2688	powershell.exe
896	powershell.exe
5656	powershell.exe
1672	powershell.exe
4940	powershell.exe
5808	powershell.exe
1964	powershell.exe
3368	powershell.exe
2496	powershell.exe
1156	powershell.exe
2468	powershell.exe
3500	powershell.exe
3680	powershell.exe
2832	powershell.exe
3208	powershell.exe
4388	powershell.exe
4664	powershell.exe
2972	powershell.exe
4304	powershell.exe
2880	powershell.exe
4344	powershell.exe
5568	powershell.exe
1448	powershell.exe
2264	powershell.exe
1340	powershell.exe
1384	powershell.exe
2644	powershell.exe
4816	powershell.exe
1900	powershell.exe
4644	powershell.exe
5432	powershell.exe
5768	powershell.exe
1396	powershell.exe
1344	powershell.exe
2280	powershell.exe
3160	powershell.exe
2892	powershell.exe
3472	powershell.exe
3604	powershell.exe
5180	powershell.exe
5916	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	powershell.exe
4816	powershell.exe
3016	powershell.exe
3016	powershell.exe
1360	powershell.exe
1360	powershell.exe
2972	powershell.exe
2972	powershell.exe
1156	powershell.exe
1156	powershell.exe
3052	powershell.exe
3052	powershell.exe
3568	powershell.exe
3568	powershell.exe
1676	powershell.exe
1676	powershell.exe
5180	powershell.exe
5180	powershell.exe
5584	powershell.exe
5584	powershell.exe
4304	powershell.exe
4304	powershell.exe
2780	powershell.exe
2780	powershell.exe
5808	powershell.exe
5808	powershell.exe
3208	powershell.exe
3208	powershell.exe
4388	powershell.exe
4388	powershell.exe
3780	powershell.exe
3780	powershell.exe
1668	powershell.exe
1668	powershell.exe
2816	powershell.exe
2816	powershell.exe
3132	powershell.exe
3132	powershell.exe
1384	powershell.exe
1384	powershell.exe
3224	powershell.exe
3224	powershell.exe
2688	powershell.exe
2688	powershell.exe
5432	powershell.exe
5432	powershell.exe
5936	powershell.exe
5936	powershell.exe
1964	powershell.exe
1964	powershell.exe
4160	powershell.exe
4160	powershell.exe
4652	powershell.exe
4652	powershell.exe
896	powershell.exe
896	powershell.exe
2820	powershell.exe
2820	powershell.exe
1576	powershell.exe
1576	powershell.exe
5768	powershell.exe
5768	powershell.exe
3392	powershell.exe
3392	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeIncreaseQuotaPrivilege	4816	powershell.exe
Token: SeSecurityPrivilege	4816	powershell.exe
Token: SeTakeOwnershipPrivilege	4816	powershell.exe
Token: SeLoadDriverPrivilege	4816	powershell.exe
Token: SeSystemProfilePrivilege	4816	powershell.exe
Token: SeSystemtimePrivilege	4816	powershell.exe
Token: SeProfSingleProcessPrivilege	4816	powershell.exe
Token: SeIncBasePriorityPrivilege	4816	powershell.exe
Token: SeCreatePagefilePrivilege	4816	powershell.exe
Token: SeBackupPrivilege	4816	powershell.exe
Token: SeRestorePrivilege	4816	powershell.exe
Token: SeShutdownPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeSystemEnvironmentPrivilege	4816	powershell.exe
Token: SeRemoteShutdownPrivilege	4816	powershell.exe
Token: SeUndockPrivilege	4816	powershell.exe
Token: SeManageVolumePrivilege	4816	powershell.exe
Token: 33	4816	powershell.exe
Token: 34	4816	powershell.exe
Token: 35	4816	powershell.exe
Token: 36	4816	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeIncreaseQuotaPrivilege	3016	powershell.exe
Token: SeSecurityPrivilege	3016	powershell.exe
Token: SeTakeOwnershipPrivilege	3016	powershell.exe
Token: SeLoadDriverPrivilege	3016	powershell.exe
Token: SeSystemProfilePrivilege	3016	powershell.exe
Token: SeSystemtimePrivilege	3016	powershell.exe
Token: SeProfSingleProcessPrivilege	3016	powershell.exe
Token: SeIncBasePriorityPrivilege	3016	powershell.exe
Token: SeCreatePagefilePrivilege	3016	powershell.exe
Token: SeBackupPrivilege	3016	powershell.exe
Token: SeRestorePrivilege	3016	powershell.exe
Token: SeShutdownPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeSystemEnvironmentPrivilege	3016	powershell.exe
Token: SeRemoteShutdownPrivilege	3016	powershell.exe
Token: SeUndockPrivilege	3016	powershell.exe
Token: SeManageVolumePrivilege	3016	powershell.exe
Token: 33	3016	powershell.exe
Token: 34	3016	powershell.exe
Token: 35	3016	powershell.exe
Token: 36	3016	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeIncreaseQuotaPrivilege	1360	powershell.exe
Token: SeSecurityPrivilege	1360	powershell.exe
Token: SeTakeOwnershipPrivilege	1360	powershell.exe
Token: SeLoadDriverPrivilege	1360	powershell.exe
Token: SeSystemProfilePrivilege	1360	powershell.exe
Token: SeSystemtimePrivilege	1360	powershell.exe
Token: SeProfSingleProcessPrivilege	1360	powershell.exe
Token: SeIncBasePriorityPrivilege	1360	powershell.exe
Token: SeCreatePagefilePrivilege	1360	powershell.exe
Token: SeBackupPrivilege	1360	powershell.exe
Token: SeRestorePrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeSystemEnvironmentPrivilege	1360	powershell.exe
Token: SeRemoteShutdownPrivilege	1360	powershell.exe
Token: SeUndockPrivilege	1360	powershell.exe
Token: SeManageVolumePrivilege	1360	powershell.exe
Token: 33	1360	powershell.exe
Token: 34	1360	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 4816	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	89
PID 5336 wrote to memory of 3016	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	93
PID 5336 wrote to memory of 1360	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	95
PID 5336 wrote to memory of 2972	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	97
PID 5336 wrote to memory of 1156	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	99
PID 5336 wrote to memory of 3052	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	101
PID 5336 wrote to memory of 3568	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	103
PID 5336 wrote to memory of 1676	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	105
PID 5336 wrote to memory of 5180	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	107
PID 5336 wrote to memory of 5584	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	109
PID 5336 wrote to memory of 4304	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	111
PID 5336 wrote to memory of 2780	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	113
PID 5336 wrote to memory of 5808	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	115
PID 5336 wrote to memory of 3208	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	117
PID 5336 wrote to memory of 4388	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	119
PID 5336 wrote to memory of 3780	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	121
PID 5336 wrote to memory of 1668	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	123
PID 5336 wrote to memory of 2816	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	125
PID 5336 wrote to memory of 3132	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	127
PID 5336 wrote to memory of 1384	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	129
PID 5336 wrote to memory of 3224	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	160
PID 5336 wrote to memory of 2688	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	133
PID 5336 wrote to memory of 5432	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	135
PID 5336 wrote to memory of 5936	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	137
PID 5336 wrote to memory of 1964	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	139
PID 5336 wrote to memory of 4160	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	141
PID 5336 wrote to memory of 4652	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	143
PID 5336 wrote to memory of 896	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	145
PID 5336 wrote to memory of 2820	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	227
PID 5336 wrote to memory of 1576	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	149
PID 5336 wrote to memory of 5768	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	180
PID 5336 wrote to memory of 3392	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	153
PID 5336 wrote to memory of 916	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	212
PID 5336 wrote to memory of 4912	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	157
PID 5336 wrote to memory of 5272	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	159
PID 5336 wrote to memory of 1008	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	161
PID 5336 wrote to memory of 3776	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	163
PID 5336 wrote to memory of 4412	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	165
PID 5336 wrote to memory of 4856	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	167
PID 5336 wrote to memory of 5876	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	169
PID 5336 wrote to memory of 2028	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	171
PID 5336 wrote to memory of 704	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	173
PID 5336 wrote to memory of 3292	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	232
PID 5336 wrote to memory of 460	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	298
PID 5336 wrote to memory of 568	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	179
PID 5336 wrote to memory of 5840	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	181
PID 5336 wrote to memory of 1396	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	183
PID 5336 wrote to memory of 1344	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	185
PID 5336 wrote to memory of 5860	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	187
PID 5336 wrote to memory of 5180	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	314
PID 5336 wrote to memory of 5656	5336	2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5005438d277cbe62b07d52f7b117ef4_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5272
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:3084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1880
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5432
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:5360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -Command "try { (Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | Select -First 1 -Expand CurrentTemperature)/10 - 273 } catch { -1 }"
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact