cc7fc68846197b2b6b212d6ac9fc14429b499ceae4559f9f65f02a10b3081d69

Analysis

max time kernel
70s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe
Size 11.7MB
Sample260821-htmcysvejg
SHA256 cc7fc68846197b2b6b212d6ac9fc14429b499ceae4559f9f65f02a10b3081d69
MD5 f83cd793294b894dbe66e190ad01aa98
SHA1 ae40b4f501ceb1d9bc27b8d8d621cda1a4bd0cfc
SHA512 fcf72658b22499cab4dac6db93398a8823c11272bdc0257dfe42e1168463ad223b9f73ad7eb2ae63822721610e5291cf8cf86e858fc4906605d947dd1ba96bcf
SSDEEP 196608:RlY0sxTlzRWW5nrzIvcvu3oVRWqO96FP7ID7SS9dxhoaq:RlY0OTjzdRWb2Sb7Wa
TLSH
T110C633A1E602DC94C4EBDDB52D05EDB0B639BE7D268264CCE1B7354C07335921EAC3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Detects executables containing many references to VEEAM. Observed in ransomware 11 IoCs

resource	yara_rule
behavioral2/memory/2368-43-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-115-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-119-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-135-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-184-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-262-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-300-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-315-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-346-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-419-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/memory/2368-440-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/2368-0-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-43-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-115-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-119-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-135-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-184-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-262-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-300-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-315-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-346-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-419-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX
behavioral2/memory/2368-440-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	UPX

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4756	netsh.exe
3424	netsh.exe
2968	netsh.exe

Loads dropped DLL 2 IoCs

pid	Process
5564	powershell.exe
5564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4404	powershell.exe
4648	powershell.exe
4612	powershell.exe
2924	powershell.exe
200	powershell.exe
5112	powershell.exe
1552	powershell.exe
5868	powershell.exe
2072	powershell.exe
1060	powershell.exe
4648	powershell.exe
1788	powershell.exe
1488	powershell.exe
2448	powershell.exe
4236	powershell.exe
2996	powershell.exe
2792	powershell.exe
3960	powershell.exe
5564	powershell.exe
4452	powershell.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1972	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2320	tasklist.exe
5476	tasklist.exe
4776	tasklist.exe
1212	tasklist.exe
712	tasklist.exe
2072	tasklist.exe
3872	tasklist.exe
5260	tasklist.exe
5912	tasklist.exe
4320	tasklist.exe
6092	tasklist.exe
3812	tasklist.exe
4892	tasklist.exe
3816	tasklist.exe
4120	tasklist.exe
4552	tasklist.exe
1672	tasklist.exe
2192	tasklist.exe
1488	tasklist.exe
5452	tasklist.exe
1776	tasklist.exe
1156	tasklist.exe
3232	tasklist.exe
1256	tasklist.exe
6064	tasklist.exe
5888	tasklist.exe
5936	tasklist.exe
1972	tasklist.exe
2776	tasklist.exe
6020	tasklist.exe
1312	tasklist.exe
6092	tasklist.exe
3080	tasklist.exe
4160	tasklist.exe
2952	tasklist.exe
2260	tasklist.exe
2968	tasklist.exe
2388	tasklist.exe
4956	tasklist.exe
1464	tasklist.exe
1896	tasklist.exe
5560	tasklist.exe
2288	tasklist.exe
3816	tasklist.exe
3332	tasklist.exe
676	tasklist.exe
1476	tasklist.exe
4872	tasklist.exe
3144	tasklist.exe
3712	tasklist.exe
5280	tasklist.exe
1776	tasklist.exe
1212	tasklist.exe
2452	tasklist.exe
3140	tasklist.exe
4692	tasklist.exe
4496	tasklist.exe
3544	tasklist.exe
3080	tasklist.exe
2904	tasklist.exe
6064	tasklist.exe
1396	tasklist.exe
1544	tasklist.exe
3380	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4404	cscript.exe
2852	cscript.exe
1512	cscript.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2368-0-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-43-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-115-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-119-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-135-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-184-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-262-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-300-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-315-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-346-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-419-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx
behavioral2/memory/2368-440-0x00007FF7FB310000-0x00007FF7FEA71000-memory.dmp	upx

Hide Artifacts: Ignore Process Interrupts 1 TTPs 45 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5892	powershell.exe
1168	powershell.exe
2792	powershell.exe
2072	powershell.exe
2128	powershell.exe
3900	powershell.exe
4452	powershell.exe
2660	powershell.exe
5040	powershell.exe
2344	powershell.exe
1584	powershell.exe
2016	powershell.exe
1788	powershell.exe
3108	powershell.exe
3876	powershell.exe
1180	powershell.exe
3580	powershell.exe
4676	powershell.exe
4844	powershell.exe
2152	powershell.exe
5368	powershell.exe
4872	powershell.exe
4288	powershell.exe
2752	powershell.exe
3232	powershell.exe
712	powershell.exe
2028	powershell.exe
2932	powershell.exe
4548	powershell.exe
1448	powershell.exe
5064	powershell.exe
260	powershell.exe
2588	powershell.exe
3152	powershell.exe
5672	powershell.exe
5724	powershell.exe
760	powershell.exe
3960	powershell.exe
3008	powershell.exe
3404	powershell.exe
4180	powershell.exe
3972	powershell.exe
708	powershell.exe
5144	powershell.exe
5320	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2956	sc.exe
4516	sc.exe
1788	sc.exe
2416	sc.exe
4044	sc.exe
928	sc.exe
4504	sc.exe
2352	sc.exe
3348	sc.exe
744	sc.exe
2520	sc.exe
4140	sc.exe
1488	sc.exe
3888	sc.exe
1228	sc.exe
4084	sc.exe
2968	sc.exe
5612	sc.exe
2752	sc.exe
4132	sc.exe
5780	sc.exe
4672	sc.exe
3152	sc.exe
2200	sc.exe
4084	sc.exe
5840	sc.exe
1008	sc.exe
1128	sc.exe
2512	sc.exe
4972	sc.exe
3160	sc.exe
1736	sc.exe
2508	sc.exe
1388	sc.exe
4264	sc.exe
2652	sc.exe
1972	sc.exe
4716	sc.exe
3024	sc.exe
2616	sc.exe
1312	sc.exe
2084	sc.exe
5536	sc.exe
4140	sc.exe
1448	sc.exe
5452	sc.exe
6076	sc.exe
4356	sc.exe
4880	sc.exe
696	sc.exe
1536	sc.exe
3232	sc.exe
1452	sc.exe
4080	sc.exe
4600	sc.exe
3520	sc.exe
4332	sc.exe
2512	sc.exe
4156	sc.exe
3496	sc.exe
4604	sc.exe
2516	sc.exe
1432	sc.exe
1480	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1948	cmd.exe
1088	cmd.exe
5852	cmd.exe
3100	cmd.exe
3496	cmd.exe
4716	cmd.exe
2328	cmd.exe
3520	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5108	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3784	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	powershell.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3784	netstat.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5652	reg.exe
1384	reg.exe
1208	reg.exe
2516	reg.exe
1328	reg.exe
828	reg.exe
4120	reg.exe
4164	reg.exe
2180	reg.exe
6020	reg.exe
4544	reg.exe
796	reg.exe
2920	reg.exe
1540	reg.exe
4672	reg.exe
4648	reg.exe
2520	reg.exe
4084	reg.exe
4892	reg.exe
4080	reg.exe
1352	reg.exe
1180	reg.exe
4320	reg.exe
4156	reg.exe
5260	reg.exe
5812	reg.exe
4648	reg.exe
4756	reg.exe
2752	reg.exe
5508	reg.exe
5304	reg.exe
916	reg.exe
3228	reg.exe
3768	reg.exe
2932	reg.exe
4356	reg.exe
3524	reg.exe
2900	reg.exe
588	reg.exe
5184	reg.exe
696	reg.exe
2180	reg.exe
4112	reg.exe
3948	reg.exe
4108	reg.exe
5444	reg.exe
760	reg.exe
1464	reg.exe
3496	reg.exe
3108	reg.exe
5900	reg.exe
2060	reg.exe
1512	reg.exe
4204	reg.exe
4732	reg.exe
5452	reg.exe
5248	reg.exe
1436	reg.exe
1736	reg.exe
4300	reg.exe
5920	reg.exe
5228	reg.exe
3768	reg.exe
1900	reg.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
4676	powershell.exe
4676	powershell.exe
4676	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
708	powershell.exe
708	powershell.exe
708	powershell.exe
4204	wmic.exe
4204	wmic.exe
4204	wmic.exe
4204	wmic.exe
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
5564	powershell.exe
5564	powershell.exe
5564	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
1060	powershell.exe
1060	powershell.exe
1060	powershell.exe
1788	powershell.exe
1788	powershell.exe
1788	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
3900	powershell.exe
3900	powershell.exe
5112	powershell.exe
5112	powershell.exe
3900	powershell.exe
5112	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	2868	tasklist.exe
Token: SeDebugPrivilege	712	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe
Token: SeDebugPrivilege	3808	tasklist.exe
Token: SeDebugPrivilege	1312	tasklist.exe
Token: SeDebugPrivilege	6092	tasklist.exe
Token: SeDebugPrivilege	1392	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	4204	wmic.exe
Token: SeSecurityPrivilege	4204	wmic.exe
Token: SeTakeOwnershipPrivilege	4204	wmic.exe
Token: SeLoadDriverPrivilege	4204	wmic.exe
Token: SeSystemProfilePrivilege	4204	wmic.exe
Token: SeSystemtimePrivilege	4204	wmic.exe
Token: SeProfSingleProcessPrivilege	4204	wmic.exe
Token: SeIncBasePriorityPrivilege	4204	wmic.exe
Token: SeCreatePagefilePrivilege	4204	wmic.exe
Token: SeBackupPrivilege	4204	wmic.exe
Token: SeRestorePrivilege	4204	wmic.exe
Token: SeShutdownPrivilege	4204	wmic.exe
Token: SeDebugPrivilege	4204	wmic.exe
Token: SeSystemEnvironmentPrivilege	4204	wmic.exe
Token: SeRemoteShutdownPrivilege	4204	wmic.exe
Token: SeUndockPrivilege	4204	wmic.exe
Token: SeManageVolumePrivilege	4204	wmic.exe
Token: 33	4204	wmic.exe
Token: 34	4204	wmic.exe
Token: 35	4204	wmic.exe
Token: 36	4204	wmic.exe
Token: SeIncreaseQuotaPrivilege	4204	wmic.exe
Token: SeSecurityPrivilege	4204	wmic.exe
Token: SeTakeOwnershipPrivilege	4204	wmic.exe
Token: SeLoadDriverPrivilege	4204	wmic.exe
Token: SeSystemProfilePrivilege	4204	wmic.exe
Token: SeSystemtimePrivilege	4204	wmic.exe
Token: SeProfSingleProcessPrivilege	4204	wmic.exe
Token: SeIncBasePriorityPrivilege	4204	wmic.exe
Token: SeCreatePagefilePrivilege	4204	wmic.exe
Token: SeBackupPrivilege	4204	wmic.exe
Token: SeRestorePrivilege	4204	wmic.exe
Token: SeShutdownPrivilege	4204	wmic.exe
Token: SeDebugPrivilege	4204	wmic.exe
Token: SeSystemEnvironmentPrivilege	4204	wmic.exe
Token: SeRemoteShutdownPrivilege	4204	wmic.exe
Token: SeUndockPrivilege	4204	wmic.exe
Token: SeManageVolumePrivilege	4204	wmic.exe
Token: 33	4204	wmic.exe
Token: 34	4204	wmic.exe
Token: 35	4204	wmic.exe
Token: 36	4204	wmic.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeSecurityPrivilege	4764	auditpol.exe
Token: SeDebugPrivilege	4648	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2920	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	90
PID 2368 wrote to memory of 4676	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	92
PID 2368 wrote to memory of 2328	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	93
PID 2368 wrote to memory of 2120	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	169
PID 2368 wrote to memory of 4404	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	232
PID 2368 wrote to memory of 1788	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	171
PID 2368 wrote to memory of 2868	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	103
PID 2368 wrote to memory of 5336	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	105
PID 2368 wrote to memory of 696	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	178
PID 2368 wrote to memory of 5428	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	109
PID 2368 wrote to memory of 712	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	111
PID 2368 wrote to memory of 4600	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	113
PID 2368 wrote to memory of 5840	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	116
PID 2368 wrote to memory of 2968	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	227
PID 2368 wrote to memory of 4844	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	120
PID 2368 wrote to memory of 5672	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	122
PID 2368 wrote to memory of 1084	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	124
PID 2368 wrote to memory of 6104	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	126
PID 2368 wrote to memory of 3144	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	128
PID 2368 wrote to memory of 4728	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	130
PID 2368 wrote to memory of 1536	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	132
PID 2368 wrote to memory of 2388	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	134
PID 2368 wrote to memory of 6020	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	463
PID 2368 wrote to memory of 1676	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	138
PID 2368 wrote to memory of 2516	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	425
PID 2368 wrote to memory of 3808	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	142
PID 2368 wrote to memory of 976	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	368
PID 2368 wrote to memory of 4704	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	146
PID 2368 wrote to memory of 3160	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	240
PID 2368 wrote to memory of 1312	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	476
PID 2368 wrote to memory of 2492	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	152
PID 2368 wrote to memory of 4664	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	154
PID 2368 wrote to memory of 2956	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	156
PID 2368 wrote to memory of 4608	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	204
PID 2368 wrote to memory of 6092	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	718
PID 2368 wrote to memory of 5312	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	162
PID 2368 wrote to memory of 2520	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	354
PID 2368 wrote to memory of 1392	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	247
PID 2368 wrote to memory of 2932	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	494
PID 2368 wrote to memory of 4056	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	170
PID 2368 wrote to memory of 2320	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	551
PID 2368 wrote to memory of 5488	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	174
PID 2368 wrote to memory of 1712	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	176
PID 2368 wrote to memory of 696	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	178
PID 2368 wrote to memory of 3712	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	349
PID 2368 wrote to memory of 6124	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	182
PID 2368 wrote to memory of 4600	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	875
PID 2368 wrote to memory of 5780	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	819
PID 2368 wrote to memory of 708	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	939
PID 2368 wrote to memory of 4204	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1138
PID 2368 wrote to memory of 2072	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1318
PID 2368 wrote to memory of 2016	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	195
PID 2368 wrote to memory of 1780	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1350
PID 2016 wrote to memory of 2852	2016	powershell.exe	199
PID 2368 wrote to memory of 2452	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1322
PID 2368 wrote to memory of 1168	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	202
PID 2368 wrote to memory of 4608	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	204
PID 2368 wrote to memory of 5040	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1365
PID 2368 wrote to memory of 5024	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1285
PID 2368 wrote to memory of 2920	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	210
PID 2368 wrote to memory of 5796	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	212
PID 2368 wrote to memory of 5228	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	583
PID 2368 wrote to memory of 1512	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1384
PID 2368 wrote to memory of 4080	2368	2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe	1389

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f83cd793294b894dbe66e190ad01aa98_hive.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Zabbix /s
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' Import-Module ActiveDirectory -ErrorAction SilentlyContinue $dc = Get-ADDomainController -Identity $env:COMPUTERNAME -ErrorAction SilentlyContinue if ($dc) { $forest = Get-ADForest -ErrorAction SilentlyContinue $out = [PSCustomObject]@{ IsDomainController = $true Domain = $dc.Domain Forest = $forest.Name Site = $dc.Site Roles = @($dc.OperationMasterRoles | ForEach-Object { $_.ToString() }) } ConvertTo-Json $out -Compress } else { Write-Output '{}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:2328
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Zabbix /s
  2⤵
  PID:2120
- C:\Windows\system32\cscript.exe
  cscript //Nologo C:\Windows\System32\slmgr.vbs /dlv
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4404
- C:\Windows\system32\sc.exe
  sc query "Zabbix Agent"
  2⤵
  - Launches sc.exe
  PID:1788
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq zabbix_agentd.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\InfluxData\Telegraf /s
  2⤵
  PID:5336
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\InfluxData\Telegraf /s
  2⤵
  - Modifies registry key
  PID:696
- C:\Windows\system32\sc.exe
  sc query telegraf
  2⤵
  PID:5428
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq telegraf.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Prometheus\Node Exporter" /s
  2⤵
  PID:4600
- C:\Windows\system32\sc.exe
  sc query prometheus-node-exporter
  2⤵
  - Launches sc.exe
  PID:5840
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq node_exporter.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $products = Get-WmiObject SoftwareLicensingProduct | Where-Object { $_.LicenseStatus -eq 1 -or $_.LicenseStatus -eq 0 } | Select-Object Name, ApplicationID, LicenseStatus, ProductKeyChannel, PartialProductKey ConvertTo-Json $products -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Datadog\Datadog Agent" /s
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Datadog\Datadog Agent" /s
  2⤵
  PID:1084
- C:\Windows\system32\sc.exe
  sc query datadog-agent
  2⤵
  PID:6104
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq agent.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\NewRelic\Infrastructure Agent" /s
  2⤵
  PID:4728
- C:\Windows\system32\sc.exe
  sc query newrelic-infra
  2⤵
  - Launches sc.exe
  PID:1536
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq newrelic-infra.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\SolarWinds\Agent /s
  2⤵
  PID:6020
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\SolarWinds\Agent /s
  2⤵
  PID:1676
- C:\Windows\system32\sc.exe
  sc query SolarWinds.Agent
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SolarWinds.AgentService.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Splunk\Universal Forwarder" /s
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Splunk\Universal Forwarder" /s
  2⤵
  PID:4704
- C:\Windows\system32\sc.exe
  sc query SplunkForwarder
  2⤵
  - Launches sc.exe
  PID:3160
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq splunkd.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Microsoft Operations Manager" /s
  2⤵
  PID:2492
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Microsoft Operations Manager" /s
  2⤵
  PID:4664
- C:\Windows\system32\sc.exe
  sc query HealthService
  2⤵
  - Launches sc.exe
  PID:2956
- C:\Windows\system32\sc.exe
  sc query SystemCenterManagement
  2⤵
  PID:4608
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq MonitoringHost.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Nagios\NRPE /s
  2⤵
  PID:5312
- C:\Windows\system32\sc.exe
  sc query NRPE
  2⤵
  - Launches sc.exe
  PID:2520
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nrpe.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Grafana\Agent /s
  2⤵
  PID:2932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2120
- C:\Windows\system32\sc.exe
  sc query "Grafana Agent"
  2⤵
  PID:4056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1788
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq agent-windows-amd64.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Amazon\SSM /s
  2⤵
  PID:5488
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Amazon\SSM /s
  2⤵
  PID:1712
- C:\Windows\system32\sc.exe
  sc query AmazonSSMAgent
  2⤵
  - Launches sc.exe
  PID:696
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq ssm-agent-worker.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Azure Arc" /s
  2⤵
  PID:6124
- C:\Windows\system32\sc.exe
  sc query himds
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq azcmagent.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $sys = [System.Environment]::GetEnvironmentVariables('Machine') $user = [System.Environment]::GetEnvironmentVariables('User') $out = [PSCustomObject]@{ System = $sys.GetEnumerator() | ForEach-Object { [PSCustomObject]@{ Name = $_.Key; Value = $_.Value } } User = $user.GetEnumerator() | ForEach-Object { [PSCustomObject]@{ Name = $_.Key; Value = $_.Value } } } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\System32\Wbem\wmic.exe
  wmic qfe get HotFixID,Description,InstalledOn /format:csv
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command " $session = New-Object -ComObject Microsoft.Update.Session $searcher = $session.CreateUpdateSearcher() try { $result = $searcher.Search(\"IsInstalled=0 and Type='Software'\") $updates = @() foreach ($update in $result.Updates) { $obj = @{ Title = $update.Title; KB = ($update.KBArticleIDs -join ',') } $updates += $obj } $updates | ConvertTo-Json -Compress } catch { @{ Error = $_.Exception.Message } | ConvertTo-Json -Compress }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $paths = @( \"C:\Program Files\Microsoft Office\Office16\ospp.vbs\", \"C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs\", \"C:\Program Files\Microsoft Office\Office15\ospp.vbs\", \"C:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs\" ) foreach ($p in $paths) { if (Test-Path $p) { cscript //Nologo $p /dstatus break } } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\cscript.exe
    "C:\Windows\system32\cscript.exe" //Nologo "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2852
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP" /s
  2⤵
  PID:1780
- C:\Program Files\dotnet\dotnet.exe
  dotnet --list-runtimes
  2⤵
  - System Time Discovery
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $locale = Get-WinSystemLocale $culture = Get-Culture $tz = Get-TimeZone $langs = Get-WinUserLanguageList | ForEach-Object { $_.LanguageTag } $kb = Get-WinUserLanguageList | ForEach-Object { $_.InputMethodTips } $out = [PSCustomObject]@{ SystemLocale = $locale.Name Culture = $culture.Name TimeZone = $tz.StandardName Languages = $langs Keyboards = $kb } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
  2⤵
  - Checks processor information in registry
  PID:4608
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v VendorIdentifier
  2⤵
  - Checks processor information in registry
  PID:5024
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin
  2⤵
  - Modifies registry key
  PID:2920
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v FeatureSet
  2⤵
  - Checks processor information in registry
  PID:5796
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot /v State
  2⤵
  - Modifies registry key
  PID:5228
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
  2⤵
  - Modifies registry key
  PID:1512
- C:\Windows\system32\reg.exe
  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v Identifier
  2⤵
  - Checks processor information in registry
  PID:4080
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
  2⤵
  PID:5652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' $dll = 'C:\ProgramData\LibreHardwareMonitor\LibreHardwareMonitorLib.dll' try { [Reflection.Assembly]::LoadFrom($dll) | Out-Null } catch { Write-Output 'LOAD_FAIL'; exit 2 } $c = New-Object LibreHardwareMonitor.Hardware.Computer $c.IsCpuEnabled=$true $c.IsGpuEnabled=$true $c.IsMotherboardEnabled=$true $c.IsControllerEnabled=$true $c.IsStorageEnabled=$true $c.IsBatteryEnabled=$true $c.IsNetworkEnabled=$true try { $c.Open() } catch {} $out = New-Object System.Collections.ArrayList function Add-LhmSensors($hw) { try { $hw.Update() } catch {} foreach ($s in $hw.Sensors) { [void]$out.Add([PSCustomObject]@{ Hardware=[string]$hw.Name; HardwareType=[string]$hw.HardwareType; Name=[string]$s.Name; SensorType=[string]$s.SensorType; Identifier=[string]$s.Identifier; Value=$s.Value; Min=$s.Min; Max=$s.Max }) } foreach ($sub in $hw.SubHardware) { Add-LhmSensors $sub } } foreach ($hw in $c.Hardware) { Add-LhmSensors $hw } try { $c.Close() } catch {} $out | ConvertTo-Json -Compress -Depth 4 "
  2⤵
  - Loads dropped DLL
  - Command and Scripting Interpreter: PowerShell
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3424
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2968
- C:\Windows\system32\netsh.exe
  netsh advfirewall show currentprofile
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "ConvertTo-Json @(Get-Tpm)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\system32\net.exe
  net accounts
  2⤵
  PID:5640
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 accounts
    3⤵
    PID:3812
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v PasswordComplexity
  2⤵
  - Modifies registry key
  PID:1540
- C:\Windows\system32\auditpol.exe
  auditpol /get /category:*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' Get-PhysicalDisk | ForEach-Object { $c = $_ | Get-StorageReliabilityCounter [PSCustomObject]@{ DeviceId = [string]$_.DeviceId FriendlyName = [string]$_.FriendlyName SerialNumber = [string]$_.SerialNumber MediaType = [string]$_.MediaType BusType = [string]$_.BusType HealthStatus = [string]$_.HealthStatus OperationalStatus = (($_.OperationalStatus | ForEach-Object { [string]$_ }) -join ',') Size = $_.Size Temperature = $c.Temperature Wear = $c.Wear PowerOnHours = $c.PowerOnHours StartStopCycles = $c.StartStopCycles ReadErrorsTotal = $c.ReadErrorsTotal WriteErrorsTotal = $c.WriteErrorsTotal } } | ConvertTo-Json -Compress -Depth 6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue' Get-PhysicalDisk | ForEach-Object { $c = $_ | Get-StorageReliabilityCounter [PSCustomObject]@{ DeviceId = [string]$_.DeviceId FriendlyName = [string]$_.FriendlyName SerialNumber = [string]$_.SerialNumber MediaType = [string]$_.MediaType BusType = [string]$_.BusType HealthStatus = [string]$_.HealthStatus OperationalStatus = (($_.OperationalStatus | ForEach-Object { [string]$_ }) -join ',') Size = $_.Size Temperature = $c.Temperature Wear = $c.Wear PowerOnHours = $c.PowerOnHours StartStopCycles = $c.StartStopCycles ReadErrorsTotal = $c.ReadErrorsTotal WriteErrorsTotal = $c.WriteErrorsTotal } } | ConvertTo-Json -Compress -Depth 6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Windows\system32\powercfg.exe
  powercfg /list
  2⤵
  - Power Settings
  PID:1972
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\Root | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\CA | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  - Modifies registry key
  PID:5444
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /reg:64
  2⤵
  PID:5900
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber
  2⤵
  PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\TrustedPublisher | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:200
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
  2⤵
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $profiles = Get-NetConnectionProfile -ErrorAction SilentlyContinue | Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity ConvertTo-Json $profiles -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\RemoteDesktop | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\LocalMachine\WebHosting | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Windows\system32\netstat.exe
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:3784
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$PSVersionTable | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2996
- C:\Windows\system32\netsh.exe
  netsh winhttp show proxy
  2⤵
  PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\My | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ExecutionPolicy -List | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1488
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
  2⤵
  PID:1060
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\Root | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2448
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride
  2⤵
  PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $teams = Get-NetLbfoTeam -ErrorAction SilentlyContinue | Select-Object Name, TeamMembers, TeamingMode, LoadBalancingAlgorithm, Status if ($teams) { ConvertTo-Json $teams -Compress } else { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Test-WSMan -ErrorAction SilentlyContinue; $?"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path Cert:\CurrentUser\CA | Select-Object Subject, Issuer, Thumbprint, NotBefore, NotAfter, HasPrivateKey, SerialNumber, FriendlyName | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4236
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:3520
- C:\Windows\system32\w32tm.exe
  w32tm /query /status
  2⤵
  PID:3404
- C:\Windows\system32\sc.exe
  sc query w32time
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters /v Type
  2⤵
  PID:4204
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterRdma | Select-Object Name, Enabled $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $errPref = $ErrorActionPreference $ErrorActionPreference = 'SilentlyContinue' try { $samples = (Get-Counter -Counter @(\"\Processor(_Total)\% Processor Time\",\"\Memory\% Committed Bytes In Use\",\"\Memory\Available MBytes\",\"\PhysicalDisk(_Total)\Disk Reads/sec\",\"\PhysicalDisk(_Total)\Disk Writes/sec\",\"\PhysicalDisk(_Total)\% Disk Time\",\"\System\Processor Queue Length\",\"\System\Interrupts/sec\",\"\Paging File(_Total)\% Usage\",\"\Network Interface(*)\Bytes Received/sec\",\"\Network Interface(*)\Bytes Sent/sec\") -MaxSamples 1 -ErrorAction SilentlyContinue).CounterSamples $out = @() foreach ($s in $samples) { $out += [PSCustomObject]@{ Path = $s.Path; Value = $s.CookedValue } } ConvertTo-Json $out -Compress } catch { Write-Output '[]' } $ErrorActionPreference = $errPref "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterSriov | Select-Object Name, Enabled, NumVFs $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Module -ListAvailable | Select-Object Name,Version,Path | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $nics = Get-NetAdapterRss | Select-Object Name, Enabled, NumberOfReceiveQueues, MaxProcessorCount $nics | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $props = Get-NetAdapterAdvancedProperty -AllProperties | Where-Object { $_.DisplayName -match 'Offload|ChecksumOffload|LsoV2|RscIPv4|RSC|RSS|VMQ|EncapsulatedTask|PacketCoalescing' } | Group-Object -Property Name $result = foreach ($g in $props) { $adp = $g.Group | Select-Object -First 1 [PSCustomObject]@{ Name = $adp.Name Offloads = @{} } foreach ($p in $g.Group) { $result_off = $p.DisplayName $result.Offloads[$result_off] = $p.DisplayValue } $result } $null = $result Get-NetAdapter | Select-Object Name, OffloadCapabilities, LsoV2IPv4, RscIPv4, EncapsulatedPacketTaskOffload, Rss, Vmq, PacketCoalescing | ConvertTo-Json -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3972
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
  2⤵
  PID:3584
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Mozilla\Mozilla Firefox" /v CurrentVersion
  2⤵
  PID:5436
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /v DisplayVersion
  2⤵
  PID:1208
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera /v DisplayVersion
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Opera /v DisplayVersion
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Brave /v DisplayVersion
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Brave /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:760
- C:\Windows\system32\cmd.exe
  cmd /c assoc http
  2⤵
  - Executes a command shell one-liner
  PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $apps = Get-AppxPackage | Select-Object Name, PackageFullName, Version, Publisher, InstallLocation, IsFramework ConvertTo-Json $apps -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3580
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Python\PythonCore /v Version
  2⤵
  PID:2952
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Python\PythonCore /v Version
  2⤵
  - Modifies registry key
  PID:828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3712
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Node.js /v Version
  2⤵
  - Modifies registry key
  PID:4672
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Node.js /v Version
  2⤵
  PID:3176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2520
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TeamViewer /s
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JavaSoft\Java Development Kit" /v CurrentVersion
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\TeamViewer /s
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JavaSoft\Java Runtime Environment" /v CurrentVersion
  2⤵
  PID:3524
- C:\Windows\system32\sc.exe
  sc query TeamViewer
  2⤵
  - Launches sc.exe
  PID:1008
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JavaSoft\Java Development Kit" /v CurrentVersion
  2⤵
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq TeamViewer.exe"
  2⤵
  PID:2464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment" /v CurrentVersion
  2⤵
  PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $sdks = Get-ChildItem -Path \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -Recurse -ErrorAction SilentlyContinue | Get-ItemProperty -Name Version -ErrorAction SilentlyContinue | Where-Object { $_.Version } | Select-Object -ExpandProperty Version -Unique if ($sdks) { $sdks -join \",\" } else { \"\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4452
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq TeamViewer_Service.exe"
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\AnyDesk /s
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\AnyDesk /s
  2⤵
  PID:5064
- C:\Windows\system32\sc.exe
  sc query AnyDesk
  2⤵
  - Launches sc.exe
  PID:2084
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq AnyDesk.exe"
  2⤵
  - Discovers running processes
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType System -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5320
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Google\Chrome Remote Desktop" /s
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Google\Chrome Remote Desktop" /s
  2⤵
  PID:2900
- C:\Windows\system32\sc.exe
  sc query remoting_host
  2⤵
  - Launches sc.exe
  PID:1488
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq remote_desktop.exe"
  2⤵
  PID:5184
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Splashtop Inc." /s
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Splashtop Inc." /s
  2⤵
  PID:5896
- C:\Windows\system32\sc.exe
  sc query SplashtopRemoteService
  2⤵
  - Launches sc.exe
  PID:1432
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR /s
  2⤵
  - Modifies registry key
  PID:5900
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SRManager.exe"
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Enum\USB /s
  2⤵
  PID:1552
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\RealVNC /s
  2⤵
  PID:2260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\RealVNC /s
  2⤵
  PID:1596
- C:\Windows\system32\sc.exe
  sc query vncserver
  2⤵
  PID:3976
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vncserver.exe"
  2⤵
  - Discovers running processes
  PID:5476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\UltraVNC /s
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\UltraVNC /s
  2⤵
  PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType User -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5724
- C:\Windows\system32\sc.exe
  sc query uvnc_service
  2⤵
  - Launches sc.exe
  PID:1480
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vncviewer.exe"
  2⤵
  PID:3956
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq winvnc.exe"
  2⤵
  PID:4960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2516
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\TightVNC /s
  2⤵
  PID:1228
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\TightVNC /s
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  sc query tvnserver
  2⤵
  - Launches sc.exe
  PID:4132
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq tvnserver.exe"
  2⤵
  - Discovers running processes
  PID:6064
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\RDP Wrapper" /s
  2⤵
  PID:5704
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4420
- C:\Windows\system32\sc.exe
  sc query TermService
  2⤵
  - Launches sc.exe
  PID:5536
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RDPCheck.exe"
  2⤵
  PID:4880
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RDPWInst.exe"
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\LogMeIn /s
  2⤵
  - Modifies registry key
  PID:4732
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\LogMeIn /s
  2⤵
  - Modifies registry key
  PID:2180
- C:\Windows\system32\sc.exe
  sc query LogMeIn
  2⤵
  - Launches sc.exe
  PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $dsns = Get-OdbcDsn -DsnType File -ErrorAction SilentlyContinue | Select-Object Name, DriverName, Platform, @{N='Description';E={$_.PropertyValue['Description']}} ConvertTo-Json $dsns -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:760
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq LogMeIn.exe"
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\ScreenConnect /s
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\ScreenConnect /s
  2⤵
  PID:4812
- C:\Windows\system32\sc.exe
  sc query "ScreenConnect Client"
  2⤵
  - Launches sc.exe
  PID:3520
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq ScreenConnect.ClientService.exe"
  2⤵
  - Discovers running processes
  PID:3380
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Ammyy /s
  2⤵
  PID:4244
- C:\Windows\system32\sc.exe
  sc query AmmyyAdmin
  2⤵
  - Launches sc.exe
  PID:4140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6020
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq AA_v3.exe"
  2⤵
  - Discovers running processes
  PID:2072
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\RustDesk /s
  2⤵
  PID:3100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\RustDesk /s
  2⤵
  PID:4692
- C:\Windows\system32\sc.exe
  sc query RustDesk
  2⤵
  - Launches sc.exe
  PID:4044
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq rustdesk.exe"
  2⤵
  PID:1452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Veeam\Veeam Backup and Replication" /s
  2⤵
  PID:1144
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Veeam\Veeam Backup and Replication" /s
  2⤵
  PID:1312
- C:\Windows\system32\sc.exe
  sc query VeeamBackupSvc
  2⤵
  PID:4320
- C:\Windows\system32\sc.exe
  sc query VeeamBrokerSvc
  2⤵
  - Launches sc.exe
  PID:1736
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeePassPasswordSafe2_is1 /v DisplayVersion
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  sc query VeeamMountSvc
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\KeePassPasswordSafe2_is1 /v DisplayVersion
  2⤵
  PID:4544
- C:\Windows\system32\sc.exe
  sc query VeeamDeploySvc
  2⤵
  PID:3140
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq KeePass.exe"
  2⤵
  PID:3940
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Veeam.Backup.Service.exe"
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KeePassXC /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2932
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Acronis\BackupAndRecovery /s
  2⤵
  - Modifies registry key
  PID:5652
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\KeePassXC /v DisplayVersion
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Acronis\BackupAndRecovery /s
  2⤵
  PID:1008
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq KeePassXC.exe"
  2⤵
  PID:3332
- C:\Windows\system32\sc.exe
  sc query AcronisAgent
  2⤵
  - Launches sc.exe
  PID:5780
- C:\Windows\system32\sc.exe
  sc query AcronisService
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1Password /v DisplayVersion
  2⤵
  PID:1672
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mms.exe"
  2⤵
  - Discovers running processes
  PID:5260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1Password /v DisplayVersion
  2⤵
  PID:4600
- C:\Windows\system32\sc.exe
  sc query 1Password
  2⤵
  - Launches sc.exe
  PID:4672
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq 1Password.exe"
  2⤵
  PID:3176
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq acronis_agent.exe"
  2⤵
  - Discovers running processes
  PID:4552
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bitwarden /v DisplayVersion
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup /s
  2⤵
  PID:4168
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bitwarden /v DisplayVersion
  2⤵
  PID:4692
- C:\Windows\system32\sc.exe
  sc query wbengine
  2⤵
  - Launches sc.exe
  PID:1128
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq wbengine.exe"
  2⤵
  - Discovers running processes
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Bitwarden.exe"
  2⤵
  - Discovers running processes
  PID:4776
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\OneDrive /v Version
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\OneDrive /v Version
  2⤵
  PID:1616
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dashlane /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Macrium\Reflect /s
  2⤵
  PID:1156
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\OneDrive /v Version
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Macrium\Reflect /s
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Dashlane /v DisplayVersion
  2⤵
  PID:4320
- C:\Windows\system32\sc.exe
  sc query DashlaneService
  2⤵
  PID:4916
- C:\Windows\system32\sc.exe
  sc query ReflectService
  2⤵
  - Launches sc.exe
  PID:4716
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq OneDrive.exe"
  2⤵
  PID:1916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2320
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Reflect.exe"
  2⤵
  - Discovers running processes
  PID:5888
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Dashlane.exe"
  2⤵
  - Discovers running processes
  PID:5936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dropbox /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:2900
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Veritas\Backup Exec" /s
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LastPass /v DisplayVersion
  2⤵
  PID:5184
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Dropbox /v DisplayVersion
  2⤵
  PID:5004
- C:\Windows\system32\sc.exe
  sc query DbxSvc
  2⤵
  - Launches sc.exe
  PID:3232
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Veritas\Backup Exec" /s
  2⤵
  PID:1584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LastPass /v DisplayVersion
  2⤵
  PID:2588
- C:\Windows\system32\sc.exe
  sc query BackupExecDeviceMediaService
  2⤵
  PID:5280
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Dropbox.exe"
  2⤵
  PID:4004
- C:\Windows\system32\sc.exe
  sc query BackupExecRPCService
  2⤵
  PID:3328
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq lastpass.exe"
  2⤵
  PID:4600
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq benetns.exe"
  2⤵
  - Discovers running processes
  PID:5912
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Drive" /v DisplayVersion
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RoboForm /v DisplayVersion
  2⤵
  PID:2072
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5228
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\CommVault Systems\Galaxy\Instance001" /s
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Drive" /v DisplayVersion
  2⤵
  PID:5300
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RoboForm /v DisplayVersion
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\CommVault Systems\Galaxy\Instance001" /s
  2⤵
  PID:1468
- C:\Windows\system32\sc.exe
  sc query GoogleDriveFS
  2⤵
  - Launches sc.exe
  PID:1452
- C:\Windows\system32\sc.exe
  sc query RoboFormService
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc query GalaxyCommunicator
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GoogleDriveFS.exe"
  2⤵
  PID:5696
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq robotaskbaricon.exe"
  2⤵
  PID:2664
- C:\Windows\system32\sc.exe
  sc query GalaxyClient
  2⤵
  - Launches sc.exe
  PID:2416
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cvd.exe"
  2⤵
  - Discovers running processes
  PID:4320
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NordPass /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Box Drive" /v DisplayVersion
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NordPass /v DisplayVersion
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Box Drive" /v DisplayVersion
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Cobian Backup 11" /s
  2⤵
  PID:5204
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq NordPass.exe"
  2⤵
  PID:5484
- C:\Windows\system32\sc.exe
  sc query BoxDrive
  2⤵
  - Launches sc.exe
  PID:928
- C:\Windows\system32\sc.exe
  sc query CobianBackup11
  2⤵
  - Launches sc.exe
  PID:4504
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BoxDrive.exe"
  2⤵
  PID:1896
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cbEngine.exe"
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MEGAsync /v DisplayVersion
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5248
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Symantec\Symantec System Recovery" /s
  2⤵
  PID:5368
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MEGAsync /v DisplayVersion
  2⤵
  PID:3416
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Symantec\Symantec System Recovery" /s
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Teams /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5260
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq MEGAsync.exe"
  2⤵
  PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Teams.exe"
  2⤵
  PID:2968
- C:\Windows\system32\sc.exe
  sc query VProSvc
  2⤵
  - Launches sc.exe
  PID:2352
- C:\Windows\system32\sc.exe
  sc query VProRecovery
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nextcloud /v DisplayVersion
  2⤵
  PID:5332
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vprosvc.exe"
  2⤵
  - Discovers running processes
  PID:6092
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zoom /v DisplayVersion
  2⤵
  PID:5852
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nextcloud /v DisplayVersion
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Zoom /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4300
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nextcloud.exe"
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Legato\NetWorker /s
  2⤵
  - Modifies registry key
  PID:1384
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Zoom.exe"
  2⤵
  - Discovers running processes
  PID:4872
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Legato\NetWorker /s
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Synology Drive Client" /v DisplayVersion
  2⤵
  PID:2152
- C:\Windows\system32\sc.exe
  sc query nsrexecd
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Skype /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5812
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Synology Drive Client" /v DisplayVersion
  2⤵
  PID:1724
- C:\Windows\system32\sc.exe
  sc query SynologyDriveService
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\system32\sc.exe
  sc query nsrd
  2⤵
  - Launches sc.exe
  PID:4084
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Skype /v DisplayVersion
  2⤵
  PID:1916
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq SynologyDrive.exe"
  2⤵
  PID:4164
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nsrexecd.exe"
  2⤵
  PID:3140
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Skype.exe"
  2⤵
  PID:3812
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Slack /v DisplayVersion
  2⤵
  PID:352
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\IBM\ADSM\CurrentVersion\BackupClient /s
  2⤵
  PID:5444
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync" /v DisplayVersion
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Slack /v DisplayVersion
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\IBM\ADSM\CurrentVersion\BackupClient /s
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Resilio Sync" /v DisplayVersion
  2⤵
  PID:1664
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq slack.exe"
  2⤵
  PID:4384
- C:\Windows\system32\sc.exe
  sc query "TSM Scheduler"
  2⤵
  - Launches sc.exe
  PID:3496
- C:\Windows\system32\sc.exe
  sc query ResilioSync
  2⤵
  - Launches sc.exe
  PID:4140
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Resilio Sync.exe"
  2⤵
  - Discovers running processes
  PID:2452
- C:\Windows\system32\sc.exe
  sc query "TSM Client Acceptor"
  2⤵
  PID:3100
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Discord /v DisplayVersion
  2⤵
  PID:1924
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq dsmcsvc.exe"
  2⤵
  PID:6136
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Discord /v DisplayVersion
  2⤵
  PID:3348
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pCloud Drive" /v DisplayVersion
  2⤵
  PID:1400
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Discord.exe"
  2⤵
  - Discovers running processes
  PID:1776
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\pCloud Drive" /v DisplayVersion
  2⤵
  PID:6092
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pCloud.exe"
  2⤵
  - Discovers running processes
  PID:1212
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webex /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4120
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Webex /v DisplayVersion
  2⤵
  PID:4288
- C:\Windows\system32\sc.exe
  sc query webexservice
  2⤵
  - Launches sc.exe
  PID:4604
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Server" /v DisplayVersion
  2⤵
  PID:4548
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Webex.exe"
  2⤵
  - Discovers running processes
  PID:1972
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Server" /v DisplayVersion
  2⤵
  PID:5200
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  PID:2940
- C:\Windows\system32\sc.exe
  sc query PlexService
  2⤵
  - Launches sc.exe
  PID:1448
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoToMeeting /v DisplayVersion
  2⤵
  PID:4432
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Plex Media Server.exe"
  2⤵
  - Discovers running processes
  PID:6064
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4648
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\GoToMeeting /v DisplayVersion
  2⤵
  PID:2180
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq uTorrent.exe"
  2⤵
  - Discovers running processes
  PID:4956
- C:\Windows\system32\sc.exe
  sc query "GoToMeeting Service"
  2⤵
  - Launches sc.exe
  PID:5612
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jellyfin /v DisplayVersion
  2⤵
  PID:3328
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq g2mcomm.exe"
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrent /v DisplayVersion
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Jellyfin /v DisplayVersion
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrent /v DisplayVersion
  2⤵
  PID:200
- C:\Windows\system32\sc.exe
  sc query Jellyfin
  2⤵
  - Launches sc.exe
  PID:4332
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BitTorrent.exe"
  2⤵
  - Discovers running processes
  PID:3872
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cisco Jabber" /v DisplayVersion
  2⤵
  PID:3100
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq jellyfin.exe"
  2⤵
  - Discovers running processes
  PID:2776
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Cisco Jabber" /v DisplayVersion
  2⤵
  PID:2124
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq CiscoJabber.exe"
  2⤵
  - Discovers running processes
  PID:3816
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qBittorrent /v DisplayVersion
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Emby Server" /v DisplayVersion
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\qBittorrent /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:3524
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Emby Server" /v DisplayVersion
  2⤵
  PID:5064
- C:\Windows\system32\sc.exe
  sc query EmbyServer
  2⤵
  - Launches sc.exe
  PID:5452
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RingCentral /v DisplayVersion
  2⤵
  PID:4288
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qbittorrent.exe"
  2⤵
  PID:1772
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EmbyServer.exe"
  2⤵
  - Discovers running processes
  PID:1464
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RingCentral /v DisplayVersion
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Deluge /v DisplayVersion
  2⤵
  PID:6012
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq RingCentral.exe"
  2⤵
  - Discovers running processes
  PID:1896
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kodi /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Deluge /v DisplayVersion
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Kodi /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4164
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq deluge.exe"
  2⤵
  - Discovers running processes
  PID:3812
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Telegram Desktop" /v DisplayVersion
  2⤵
  PID:1584
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq kodi.exe"
  2⤵
  PID:1008
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Telegram Desktop" /v DisplayVersion
  2⤵
  PID:5144
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Telegram.exe"
  2⤵
  - Discovers running processes
  PID:1672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4764
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq deluged.exe"
  2⤵
  - Discovers running processes
  PID:5280
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player" /v DisplayVersion
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Transmission /v DisplayVersion
  2⤵
  PID:3544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5780
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vlc.exe"
  2⤵
  - Discovers running processes
  PID:3080
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Transmission /v DisplayVersion
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spotify /v DisplayVersion
  2⤵
  PID:4500
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq transmission-qt.exe"
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spotify /v DisplayVersion
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq transmission-daemon.exe"
  2⤵
  PID:1468
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Spotify.exe"
  2⤵
  - Discovers running processes
  PID:1776
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vuze /v DisplayVersion
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iTunes /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4112
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Vuze /v DisplayVersion
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iTunes /v DisplayVersion
  2⤵
  PID:3948
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Azureus.exe"
  2⤵
  - Discovers running processes
  PID:5560
- C:\Windows\system32\sc.exe
  sc query AppleMobileDeviceService
  2⤵
  - Launches sc.exe
  PID:3152
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq iTunes.exe"
  2⤵
  - Discovers running processes
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1464
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tixati /v DisplayVersion
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Media Player" /v DisplayVersion
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam /v DisplayVersion
  2⤵
  PID:4832
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Tixati /v DisplayVersion
  2⤵
  PID:928
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq wmplayer.exe"
  2⤵
  PID:4164
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq steam.exe"
  2⤵
  PID:3900
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Tixati.exe"
  2⤵
  - Discovers running processes
  PID:3140
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Player" /v DisplayVersion
  2⤵
  PID:1352
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $exchange = Get-ExchangeServer -Identity $env:COMPUTERNAME -ErrorAction SilentlyContinue | Select-Object Name, Edition, AdminDisplayVersion, ServerRole, Site if ($exchange) { $org = Get-OrganizationConfig -ErrorAction SilentlyContinue | Select-Object Name $out = [PSCustomObject]@{ Name = $exchange.Name Edition = $exchange.Edition Version = ($exchange.AdminDisplayVersion -replace 'Version ','') ServerRole = $exchange.ServerRole.ToString() OrganizationName = $org.Name } ConvertTo-Json $out -Compress } else { Write-Output '{}' } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:2792
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Plex Media Player" /v DisplayVersion
  2⤵
  PID:4004
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EpicGamesLauncher /v DisplayVersion
  2⤵
  PID:5476
- C:\Windows\system32\sc.exe
  sc query EpicOnlineServices
  2⤵
  - Launches sc.exe
  PID:2968
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Plex Media Player.exe"
  2⤵
  PID:4600
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EpicGamesLauncher.exe"
  2⤵
  - Discovers running processes
  PID:2192
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\PostgreSQL Global Development Group\PostgreSQL" /s
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GOG Galaxy" /v DisplayVersion
  2⤵
  PID:708
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\PostgreSQL Global Development Group\PostgreSQL" /s
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\GOG Galaxy" /v DisplayVersion
  2⤵
  PID:5112
- C:\Windows\system32\sc.exe
  sc query postgresql-x64-
  2⤵
  - Launches sc.exe
  PID:2200
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GalaxyClient.exe"
  2⤵
  PID:2352
- C:\Windows\system32\sc.exe
  sc query postgresql-x86-
  2⤵
  - Launches sc.exe
  PID:6076
- C:\Windows\system32\cmd.exe
  cmd /c "sc query | findstr postgresql"
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\system32\sc.exe
    sc query
    3⤵
    - Launches sc.exe
    PID:4084
- - C:\Windows\system32\findstr.exe
    findstr postgresql
    3⤵
    PID:4132
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EA App" /v DisplayVersion
  2⤵
  PID:1772
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq postgres.exe"
  2⤵
  PID:1976
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EA App" /v DisplayVersion
  2⤵
  PID:3220
- C:\Windows\system32\sc.exe
  sc query EABackgroundService
  2⤵
  - Launches sc.exe
  PID:4356
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq EADesktop.exe"
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\MySQL AB\MySQL Server" /s
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\MySQL AB\MySQL Server" /s
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Origin /v DisplayVersion
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\MySQL\MySQL Server" /s
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Origin /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4756
- C:\Windows\system32\sc.exe
  sc query MySQL
  2⤵
  PID:3404
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mysqld.exe"
  2⤵
  PID:1544
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Origin.exe"
  2⤵
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' try { $points = Get-ComputerRestorePoint -ErrorAction SilentlyContinue | Select-Object Description, RestorePointType, @{Name='Date'; Expression={$_.ConvertToDateTime($_.CreationTime)}}, SequenceNumber if ($points) { $points | ConvertTo-Json -Compress } else { Write-Output '[]' } } catch { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:260
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\MariaDB /s
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Battle.net /v DisplayVersion
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\MariaDB /s
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Battle.net /v DisplayVersion
  2⤵
  PID:6132
- C:\Windows\system32\sc.exe
  sc query MariaDB
  2⤵
  - Launches sc.exe
  PID:4264
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Battle.net.exe"
  2⤵
  - Discovers running processes
  PID:6020
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mysqld.exe"
  2⤵
  PID:5896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:708
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ubisoft Connect" /v DisplayVersion
  2⤵
  PID:4020
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mariadbd.exe"
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Ubisoft Connect" /v DisplayVersion
  2⤵
  PID:1228
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Upc.exe"
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\MongoDB /s
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\MongoDB /s
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XboxApp /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4648
- C:\Windows\system32\sc.exe
  sc query MongoDB
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq XboxApp.exe"
  2⤵
  PID:352
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mongod.exe"
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpType
  2⤵
  PID:2724
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpFolder
  2⤵
  PID:2072
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5848
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Redis /s
  2⤵
  - Modifies registry key
  PID:3228
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq GameBar.exe"
  2⤵
  - Discovers running processes
  PID:3544
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpCount
  2⤵
  PID:2588
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Redis /s
  2⤵
  PID:200
- C:\Windows\system32\sc.exe
  sc query Redis
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $events = Get-WinEvent -FilterHashtable @{LogName='Application'; ID=1000; Level=2} -MaxEvents 5 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message $out = @() foreach ($e in $events) { $out += \"$($e.TimeCreated): $($e.Message -replace '\r|\n', ' ')\" } if ($out) { $out -join \"\n\" } else { \"\" } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:3960
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rockstar Games Launcher" /v DisplayVersion
  2⤵
  PID:3148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq redis-server.exe"
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rockstar Games Launcher" /v DisplayVersion
  2⤵
  PID:6092
- C:\Windows\system32\sc.exe
  sc query RockstarService
  2⤵
  - Launches sc.exe
  PID:3024
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Oracle /s
  2⤵
  PID:3332
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Launcher.exe"
  2⤵
  PID:760
- C:\Windows\system32\sc.exe
  sc query OracleService
  2⤵
  PID:4452
- C:\Windows\system32\sc.exe
  sc query OracleOraDB
  2⤵
  - Launches sc.exe
  PID:2616
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bethesda.net Launcher" /v DisplayVersion
  2⤵
  PID:1228
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq oracle.exe"
  2⤵
  - Discovers running processes
  PID:3816
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bethesda.net Launcher" /v DisplayVersion
  2⤵
  PID:3416
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq tnslsnr.exe"
  2⤵
  PID:1152
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq BethesdaLauncher.exe"
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SQLite /s
  2⤵
  - Modifies registry key
  PID:2752
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\VisualStudio\Setup\InstalledProducts /v Version
  2⤵
  - Modifies registry key
  PID:588
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\CockroachDB /s
  2⤵
  - Modifies registry key
  PID:5920
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\Setup\InstalledProducts /v Version
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\CockroachDB /s
  2⤵
  PID:1924
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq devenv.exe"
  2⤵
  PID:4180
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq cockroach.exe"
  2⤵
  - Discovers running processes
  PID:4160
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Firebird Project\Firebird Server" /s
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA457B21-F73E-494C-ACAB-524FDE97-0000} /v DisplayVersion
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{EA457B21-F73E-494C-ACAB-524FDE97-0000} /v DisplayVersion
  2⤵
  PID:5404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:200
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Firebird Project\Firebird Server" /s
  2⤵
  PID:2320
- C:\Windows\system32\sc.exe
  sc query FirebirdServer
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1 /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:5184
- C:\Windows\system32\sc.exe
  sc query FirebirdGuardian
  2⤵
  - Launches sc.exe
  PID:3348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5564
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Code.exe"
  2⤵
  PID:3148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq fbserver.exe"
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\JetBrains\IntelliJ IDEA" /v Version
  2⤵
  PID:108
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq fbguard.exe"
  2⤵
  - Discovers running processes
  PID:3332
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\JetBrains\IntelliJ IDEA" /v Version
  2⤵
  PID:4288
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq idea64.exe"
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Couchbase\Server /s
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Couchbase\Server /s
  2⤵
  - Modifies registry key
  PID:5304
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq idea.exe"
  2⤵
  - Discovers running processes
  PID:2952
- C:\Windows\system32\sc.exe
  sc query CouchbaseServer
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq erl.exe"
  2⤵
  - Discovers running processes
  PID:1256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\PyCharm /v Version
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\PyCharm /v Version
  2⤵
  PID:1824
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Workstation" /v ProductVersion
  2⤵
  PID:5560
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pycharm64.exe"
  2⤵
  PID:4604
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Workstation" /v ProductVersion
  2⤵
  PID:5936
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq pycharm.exe"
  2⤵
  PID:6116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' Import-Module RemoteDesktop -ErrorAction SilentlyContinue $rdsh = Get-RDServer -ErrorAction SilentlyContinue $broker = Get-RDConnectionBrokerHighAvailability -ErrorAction SilentlyContinue if ($rdsh -or $broker) { $role = if ($broker) { 'ConnectionBroker' } else { 'SessionHost' } $out = [PSCustomObject]@{ Installed = $true; Role = $role } ConvertTo-Json $out -Compress } else { Write-Output '{\"Installed\":false}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3008
- C:\Windows\system32\sc.exe
  sc query VMwareWorkstationServer
  2⤵
  - Launches sc.exe
  PID:4080
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmware-vmx.exe"
  2⤵
  PID:5436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\WebStorm /v Version
  2⤵
  PID:1544
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Player" /v ProductVersion
  2⤵
  PID:1352
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3900
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\WebStorm /v Version
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Player" /v ProductVersion
  2⤵
  PID:4956
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq webstorm64.exe"
  2⤵
  - Discovers running processes
  PID:3080
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmplayer.exe"
  2⤵
  PID:1948
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq webstorm.exe"
  2⤵
  - Discovers running processes
  PID:1156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Oracle\VirtualBox /v Version
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Oracle\VirtualBox /v Version
  2⤵
  - Modifies registry key
  PID:3948
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\PhpStorm /v Version
  2⤵
  PID:1900
- C:\Windows\system32\sc.exe
  sc query VBoxDrv
  2⤵
  - Launches sc.exe
  PID:1312
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\PhpStorm /v Version
  2⤵
  - Modifies registry key
  PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq VBoxSVC.exe"
  2⤵
  PID:5684
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq phpstorm64.exe"
  2⤵
  PID:3872
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq VirtualBoxVM.exe"
  2⤵
  PID:4364
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq phpstorm.exe"
  2⤵
  - Discovers running processes
  PID:1488
- C:\Windows\system32\qwinsta.exe
  qwinsta
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Parallels\Parallels Desktop" /v Version
  2⤵
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1180
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\Rider /v Version
  2⤵
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (1 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 1 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2752
- C:\Windows\system32\sc.exe
  sc query prl_disp_service
  2⤵
  - Launches sc.exe
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (2 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 2 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'System' } $evts = if (3 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 3 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3232
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq prl_cc.exe"
  2⤵
  - Discovers running processes
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4180
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\Rider /v Version
  2⤵
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (1 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 1 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (2 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 2 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Application' } $evts = if (3 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 3 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2660
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq rider64.exe"
  2⤵
  - Discovers running processes
  PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $filter = @{ LogName = 'Security' } $evts = if (0 -gt 0) { Get-WinEvent -FilterHashtable ($filter + @{ Level = 0 }) -Oldest } else { Get-WinEvent -FilterHashtable $filter -Oldest -ErrorAction SilentlyContinue } $evts.Count "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $evts = Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2,3 } -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object LogName, Id, ProviderName, TimeCreated, LevelDisplayName, @{N='Message';E={(($_.Message -split \"`r?`n\")[0])}} $evts | ConvertTo-Json -Depth 2 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:712
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\QEMU /v Version
  2⤵
  - Modifies registry key
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue' $evts = Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=1,2,3 } -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object LogName, Id, ProviderName, TimeCreated, LevelDisplayName, @{N='Message';E={(($_.Message -split \"`r?`n\")[0])}} $evts | ConvertTo-Json -Depth 2 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4872
- C:\Windows\system32\secedit.exe
  secedit /export /cfg C:\Users\Admin\AppData\Local\Temp\secpol.cfg /areas SECURITYPOLICY
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\JetBrains\CLion /v Version
  2⤵
  PID:1616
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\QEMU /v Version
  2⤵
  - Modifies registry key
  PID:1208
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\JetBrains\CLion /v Version
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  cmd /c type C:\Users\Admin\AppData\Local\Temp\secpol.cfg
  2⤵
  - Executes a command shell one-liner
  PID:5852
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qemu-system-x86_64.exe"
  2⤵
  - Discovers running processes
  PID:1212
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq clion64.exe"
  2⤵
  PID:4084
- C:\Windows\system32\auditpol.exe
  auditpol /get /category:*
  2⤵
  PID:6020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' try { $pref = Get-MpPreference -ErrorAction SilentlyContinue if ($pref) { $out = [PSCustomObject]@{ ExclusionPath = $pref.ExclusionPath ExclusionExtension = $pref.ExclusionExtension ExclusionProcess = $pref.ExclusionProcess } ConvertTo-Json $out -Compress } else { Write-Output '{}' } } catch { Write-Output '{}' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2128
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq qemu.exe"
  2⤵
  PID:1452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Eclipse IDE" /v DisplayVersion
  2⤵
  PID:5684
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Eclipse IDE" /v DisplayVersion
  2⤵
  PID:3712
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq eclipse.exe"
  2⤵
  - Discovers running processes
  PID:4120
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Docker Desktop" /v DisplayVersion
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Docker Desktop" /v DisplayVersion
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NetBeans /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:1180
- C:\Windows\system32\sc.exe
  sc query com.docker.service
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\NetBeans /v DisplayVersion
  2⤵
  PID:4620
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq Docker Desktop.exe"
  2⤵
  PID:4080
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq netbeans64.exe"
  2⤵
  - Discovers running processes
  PID:3232
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft-Hyper-V-Management-PowerShell /v DisplayVersion
  2⤵
  PID:1776
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmcompute.exe"
  2⤵
  PID:5880
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq netbeans.exe"
  2⤵
  PID:712
- C:\Windows\system32\sc.exe
  sc query type= state= all
  2⤵
  - Launches sc.exe
  PID:4972
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vmms.exe"
  2⤵
  PID:3768
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sublime Text" /v DisplayVersion
  2⤵
  PID:2644
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:5452
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Sublime Text" /v DisplayVersion
  2⤵
  PID:5508
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq sublime_text.exe"
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Citrix\XenTools /v Version
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Citrix\XenTools /v Version
  2⤵
  - Modifies registry key
  PID:6020
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ /v DisplayVersion
  2⤵
  PID:3152
- C:\Windows\system32\sc.exe
  sc query xenservice
  2⤵
  PID:4140
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq xenagent.exe"
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++ /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4204
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq notepad++.exe"
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Enrollments
  2⤵
  PID:3416
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\MdmSubscriberIds" /v ""
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Atom /v DisplayVersion
  2⤵
  - Modifies registry key
  PID:4544
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\AutoPilot\Enrollments /v TenantId
  2⤵
  - Modifies registry key
  PID:1736
- C:\Windows\system32\gpresult.exe
  gpresult /r
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Atom /v DisplayVersion
  2⤵
  PID:472
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq atom.exe"
  2⤵
  - Discovers running processes
  PID:2288
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vim /v DisplayVersion
  2⤵
  PID:4168
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq vim.exe"
  2⤵
  - Discovers running processes
  PID:1476
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq gvim.exe"
  2⤵
  PID:3232
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Neovim /v DisplayVersion
  2⤵
  PID:5812
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nvim.exe"
  2⤵
  - Discovers running processes
  PID:1396
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq nvim-qt.exe"
  2⤵
  - Discovers running processes
  PID:1544
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:3100
- C:\Windows\system32\manage-bde.exe
  manage-bde -protectors -get
  2⤵
  PID:3328
- C:\Windows\system32\cmd.exe
  cmd /c "chcp 65001 >nul"
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\system32\manage-bde.exe
  manage-bde -status
  2⤵
  PID:4500
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\BitLockerStatus /v OSVHDProtected
  2⤵
  - Modifies registry key
  PID:2516
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\BitLockerStatus /v OSVolumeProtected
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v EncryptionMethod
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPM
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPMPIN
  2⤵
  - Modifies registry key
  PID:3768
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RequireTPMStartupKey
  2⤵
  PID:3876
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v MinimumPINLength
  2⤵
  - Modifies registry key
  PID:2520
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryKeyUsagePolicy
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryPasswordUsagePolicy
  2⤵
  - Modifies registry key
  PID:4320
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v HideRecoveryPage
  2⤵
  PID:108
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryURL
  2⤵
  PID:5244
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\OSDrive /v RecoveryMessage
  2⤵
  - Modifies registry key
  PID:4084
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\FDV /v EncryptionMethod
  2⤵
  PID:4092
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\FVE\RDV /v EncryptionMethod
  2⤵
  PID:3152
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceGuard /v KernelDMAProtection
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceGuard /v DeviceGuardDMAProtectionPolicy
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
  2⤵
  - Modifies registry key
  PID:796
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v RequireSecuritySignature
  2⤵
  PID:5304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2508
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v EnableSecuritySignature
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v Smb1Enabled
  2⤵
  PID:3816
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v EncryptData
  2⤵
  PID:3260
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v SmbServerNameHardeningLevel
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v RequireSecuritySignature
  2⤵
  PID:3424
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5024
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableSecuritySignature
  2⤵
  - Modifies registry key
  PID:4156
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v AllowInsecureGuestAuth
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableEncryption
  2⤵
  PID:5512
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v RequireEncryption
  2⤵
  PID:5652
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v EnableCompressedTraffic
  2⤵
  PID:1180
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication
  2⤵
  PID:588
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryption
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v PortNumber
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v PortNumber
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LMCompatibilityLevel
  2⤵
  - Modifies registry key
  PID:4892
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NtlmMinClientSec
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NtlmMinServerSec
  2⤵
  PID:4164
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 /v RestrictReceivingNTLMTraffic
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 /v RestrictSendingNTLMTraffic
  2⤵
  - Modifies registry key
  PID:3108
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters /v RestrictNTLMInDomain
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v SupportedEncryptionTypes
  2⤵
  PID:3160
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2072
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxClockSkew
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxTicketAge
  2⤵
  - Modifies registry key
  PID:916
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxRenewAge
  2⤵
  PID:2452
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v MaxServiceTicketAge
  2⤵
  PID:1448
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters /v RequireStrongKey
  2⤵
  - Modifies registry key
  PID:4356
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v AllowBasic
  2⤵
  PID:5436
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v AllowCredSSP
  2⤵
  - Modifies registry key
  PID:1352
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v HTTPSRequired
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service /v CertificateThumbprint
  2⤵
  PID:928
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging /v EnableScriptBlockLogging
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging /v EnableModuleLogging
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL
  2⤵
  PID:4500
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdminMode
  2⤵
  PID:2516
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LimitBlankPasswordUse
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NoLMHash
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallDay
  2⤵
  - Modifies registry key
  PID:5508
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v ScheduledInstallTime
  2⤵
  - Modifies registry key
  PID:3768
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v MaxSize
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v Retention
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v File
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security /v File
  2⤵
  - Modifies registry key
  PID:1328
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v CrashOnAuditFail
  2⤵
  PID:4996
- C:\Windows\system32\wsl.exe
  wsl -l -v
  2⤵
  PID:1540
- C:\Windows\system32\wsl.exe
  wsl -l
  2⤵
  PID:1312
- C:\Windows\system32\wsl.exe
  wsl --version
  2⤵
  PID:5520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $conns = Get-VpnConnection -AllUserConnection -ErrorAction SilentlyContinue if (-not $conns) { $conns = Get-VpnConnection -ErrorAction SilentlyContinue } $out = foreach ($c in $conns) { [PSCustomObject]@{ Name = $c.Name ServerAddress = $c.ServerAddress ConnectionType = $c.VpnType.ToString() Status = $c.ConnectionStatus.ToString() Enabled = $c.IsProvisioned SplitTunneling = $c.SplitTunneling } } ConvertTo-Json $out -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-SmbServerConfiguration -ErrorAction SilentlyContinue | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature, EncryptData, MaxConnectionsPerServer ConvertTo-Json $cfg -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $feats = Get-WindowsOptionalFeature -Online | Where-Object { $_.State -eq 'Enabled' } | Select-Object FeatureName, DisplayName, State ConvertTo-Json $feats -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5040
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {A20BF082-6842-4B69-A547-9B6AA65E999A}
    3⤵
    PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $feats = Get-WindowsFeature | Where-Object { $_.Installed -eq $true } | Select-Object Name, DisplayName, InstallState ConvertTo-Json $feats -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-SmbClientConfiguration -ErrorAction SilentlyContinue | Select-Object RequireSecuritySignature, EnableInsecureGuestLogons, DisableCompression ConvertTo-Json $cfg -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2344
- C:\Windows\system32\dism.exe
  dism /online /get-features /format:table
  2⤵
  PID:1144
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {AF06159B-1441-48A4-9FEF-516CEDC9C8AE}
    3⤵
    PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $shares = Get-SmbShare | Select-Object Name, Path, Description, EncryptData ConvertTo-Json $shares -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3876
- C:\Windows\system32\sc.exe
  sc query type= state=all
  2⤵
  PID:4140
- C:\Windows\system32\sc.exe
  sc query WinRM
  2⤵
  - Launches sc.exe
  PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $listeners = winrm enumerate winrm/config/listener -format:xml 2>$null if ($listeners) { $xml = [xml]$listeners $out = foreach ($l in $xml.Listeners.Listener) { [PSCustomObject]@{ Address = ($l.Address | Select-Object -First 1) Transport = ($l.Transport | Select-Object -First 1) Port = [int]($l.Port | Select-Object -First 1) Enabled = ($l.Enabled | Select-Object -First 1) -eq 'true' } } ConvertTo-Json $out -Compress } else { Write-Output '[]' } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\winrm.cmd" enumerate winrm/config/listener -format:xml"
    3⤵
    - Executes a command shell one-liner
    PID:4716
  - - C:\Windows\system32\cscript.exe
      cscript //nologo "C:\Windows\System32\winrm.vbs" enumerate winrm/config/listener -format:xml
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $shares = Get-SmbShare -ErrorAction SilentlyContinue $result = @() foreach ($share in $shares) { $access = Get-SmbShareAccess -Name $share.Name -ErrorAction SilentlyContinue foreach ($a in $access) { $result += [PSCustomObject]@{ ShareName = $share.Name Account = $a.AccountName AccessRight = $a.AccessRight AccessControlType = $a.AccessControlType } } } $result | ConvertTo-Json -Depth 3 -Compress "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1584
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist /s
  2⤵
  - Modifies registry key
  PID:2060
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist /s
  2⤵
  - Modifies registry key
  PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $pref = Get-MpPreference -ErrorAction SilentlyContinue if ($pref) { $out = @() foreach ($rule in $pref.AttackSurfaceReductionRules_Ids) { $idx = [array]::IndexOf($pref.AttackSurfaceReductionRules_Ids, $rule) $action = $pref.AttackSurfaceReductionRules_Actions[$idx] $out += [PSCustomObject]@{ RuleId = $rule Action = $action } } $out | ConvertTo-Json -Depth 3 -Compress } else { \"\" } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-MpPreference -ErrorAction SilentlyContinue).AttackSurfaceReductionOnlyConfigurations"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2932
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  PID:5672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command " $ErrorActionPreference = 'SilentlyContinue' $cfg = Get-Item WSMan:\localhost\MaxEnvelopeSizekb -ErrorAction SilentlyContinue if ($cfg) { $cfg.Value } else { 0 } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2968
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  PID:4972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Password Policy Discovery

T1201

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlackSharp.Core.dll

Path C:\ProgramData\LibreHardwareMonitor\BlackSharp.Core.dll
Size 32KB
SHA256 cafb93afcc8d8a367e21f619673d05c06887d8964867fed1371f02ded1cd3e23
MD5 af10d830d9dadf30fe9135802c2c2b3a
SHA1 f8481a61aaa04eea57834f549118f3d31039fb00
SHA512 0baed44567ed36e801abb52f0e79c4ded943fb13b8d9a20148f33fdc2c40ec691238fd254d136bda673d6041d03a406f0c0a8747f57e30930c3661f9414864ec
SSDEEP 768:3c4f44voYXoCA1lPKLXSIptrxH7iryQgbmefLPGdGD0I7riiD:bvoBL1lPEXSe1xGgbm2+d8PD
TLSH
T188E26B02A3C88733DBAE46B8F8F112614B72C762B563F71779C8A5EA4D537154A123F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskInfoToolkit.dll

Path C:\ProgramData\LibreHardwareMonitor\DiskInfoToolkit.dll
Size 882KB
SHA256 1acbf51b3c10c51c986cf43021680d34a2e38d9a5ba652bcfa9a1b5f7fc09800
MD5 0485939203a30164063ae25e10b8315d
SHA1 d9a34d47df2e7bab2cd7ea12c054b761d918f9e2
SHA512 b90a216d43a0198765942b27db36b6f933061d9da24b44bdc4d097e82c162619a2906ef51676d5d4f95ffdd7f50489a4ed9b15669a2ce59c030a00339a30df80
SSDEEP 12288:bGB1zTwxF4Nd8FmqqNASPciHXE/ywo1MsCgqivn72Gt6rFI4nLo4v:bGBxwxF4Nd8wVNAYX3u4Mxmmq4nLok
TLSH
T12E15BFB443A92D23F6AF1FF288A350404AF2B02E5637D78DCDD5D8DD98A9DD06818727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HidSharp.dll

Path C:\ProgramData\LibreHardwareMonitor\HidSharp.dll
Size 256KB
SHA256 d86690efde30ea9179f669320f39148853793b743a98b531afeaf30598e22f54
MD5 3876a747858ca11995f25a8a4a8db104
SHA1 4094d7e274f9d87d8c93f3a8aa14606dbf3994d8
SHA512 c67545f6ca74dc59690e12b00a8c0ddb848926c414f8d8af14a2290f5ed647a481542f90c7b47522c1ba32116ebd3f16a49315a86c8a8d7508759ab7335add78
SSDEEP 3072:E1lZKoJKw/ATXA2okJSY4tvmWB7pbDXQrKsbiffsv0JKdyxCCqIZ2nyreCoe+:ERJ+TXA2okMjv3BlYKYAs8iyXWyCCoe+
TLSH
T13C448D0D5BEC862FDDEF4735B43298148BF1E495A212E7AE15ACD4EA1C937C089413E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibreHardwareMonitorLib.dll

Path C:\ProgramData\LibreHardwareMonitor\LibreHardwareMonitorLib.dll
Size 1.1MB
SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
MD5 ecc49bd21fc187ba1a39b2f84bcfb9af
SHA1 eea8552e5ed715ffa6882a2c6335d4c1f9fe5ea9
SHA512 34573db40fa4482953146e852015d3a802cac263aa78910cb33f0aee271e2412494a4a6c219c785f6c7696d3fab0f79d2b257b69c5ba7b62fb424e473ec7e03a
SSDEEP 12288:oULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy7:oWSktWpw/lgdm
TLSH
T1C645290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\ProgramData\LibreHardwareMonitor\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download