File name:

ZelyanorSetup1.0.0.exe

Full analysis: https://app.any.run/tasks/096da8a6-1d28-4bf1-884d-d0b780cd3d63
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 09, 2026, 23:30:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
silentstealer
stealer
python
generic
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

328AF41E6AAC5DF70E9611D4584E8B27

SHA1:

5B99A297DED651F86A29A74404213E85EDE32BE4

SHA256:

B16E6B56B4ADAA070DE1DA74F9C6F16469182397F80D2587C5DBA3229FDF1898

SSDEEP:

786432:eEnaHx5ZPDFIBjkCVbHwycGNsSfwli+WPGQ:eEnS5ZPDFIBjkosycGNsSoli+qGQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SILENTSTEALER has been detected

      • Zelyanor.exe (PID: 8068)

    • Steals credentials from Web Browsers

      • Zelyanor.exe (PID: 8068)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7572)
      • cmd.exe (PID: 2900)

    • Actions looks like stealing of personal data

      • Zelyanor.exe (PID: 8068)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7636)
      • powershell.exe (PID: 4212)

    • Steals Discord credentials and data (YARA)

      • Zelyanor.exe (PID: 8068)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • Drops 7-zip archiver for unpacking

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • The process creates files with name similar to system file names

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • Reads security settings of Internet Explorer

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8140)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 8164)
      • cmd.exe (PID: 2480)
      • cmd.exe (PID: 3100)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 5160)
      • cmd.exe (PID: 7928)
      • cmd.exe (PID: 8180)
      • cmd.exe (PID: 2760)
      • cmd.exe (PID: 7508)
      • cmd.exe (PID: 2256)
      • cmd.exe (PID: 7284)
      • cmd.exe (PID: 7656)
      • cmd.exe (PID: 2428)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 2480)
      • cmd.exe (PID: 7708)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 1080)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 7644)
      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7068)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 7420)
      • cmd.exe (PID: 1872)
      • cmd.exe (PID: 7776)
      • cmd.exe (PID: 3048)
      • cmd.exe (PID: 7540)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 7628)
      • cmd.exe (PID: 7796)
      • cmd.exe (PID: 5712)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8056)
      • cmd.exe (PID: 7864)
      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 7540)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 1164)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 6892)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 2216)
      • cmd.exe (PID: 5700)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 7376)
      • cmd.exe (PID: 8172)
      • cmd.exe (PID: 7924)
      • cmd.exe (PID: 7068)
      • cmd.exe (PID: 5152)
      • cmd.exe (PID: 7260)
      • cmd.exe (PID: 7548)
      • cmd.exe (PID: 7596)
      • cmd.exe (PID: 7512)
      • cmd.exe (PID: 6684)
      • cmd.exe (PID: 2428)
      • cmd.exe (PID: 4828)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 5604)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 4700)
      • cmd.exe (PID: 2256)
      • cmd.exe (PID: 7364)
      • cmd.exe (PID: 4280)
      • cmd.exe (PID: 5036)
      • cmd.exe (PID: 6056)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 1316)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7836)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 2092)
      • cmd.exe (PID: 1772)
      • cmd.exe (PID: 6548)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 2092)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 5104)
      • cmd.exe (PID: 3436)
      • cmd.exe (PID: 2216)
      • cmd.exe (PID: 4704)
      • cmd.exe (PID: 3436)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 7928)
      • cmd.exe (PID: 1136)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 4704)
      • cmd.exe (PID: 8060)
      • cmd.exe (PID: 7652)
      • cmd.exe (PID: 4620)
      • cmd.exe (PID: 7448)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 4224)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 2760)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 1204)
      • cmd.exe (PID: 7240)
      • cmd.exe (PID: 7360)
      • cmd.exe (PID: 1752)
      • cmd.exe (PID: 948)
      • cmd.exe (PID: 1316)
      • cmd.exe (PID: 7576)
      • cmd.exe (PID: 948)
      • cmd.exe (PID: 7776)
      • cmd.exe (PID: 4036)
      • cmd.exe (PID: 6376)
      • cmd.exe (PID: 1340)
      • cmd.exe (PID: 7360)
      • cmd.exe (PID: 1752)
      • cmd.exe (PID: 2252)
      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 2364)
      • cmd.exe (PID: 5780)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 4964)
      • cmd.exe (PID: 6788)
      • cmd.exe (PID: 1420)
      • cmd.exe (PID: 4104)
      • cmd.exe (PID: 5888)
      • cmd.exe (PID: 8060)
      • cmd.exe (PID: 6572)
      • cmd.exe (PID: 7940)
      • cmd.exe (PID: 7228)
      • cmd.exe (PID: 3152)
      • cmd.exe (PID: 3544)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 7540)
      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 4512)
      • cmd.exe (PID: 3548)
      • cmd.exe (PID: 7520)
      • cmd.exe (PID: 6320)
      • cmd.exe (PID: 2564)
      • cmd.exe (PID: 4224)
      • cmd.exe (PID: 7088)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 7224)
      • cmd.exe (PID: 7524)
      • cmd.exe (PID: 2416)
      • cmd.exe (PID: 1112)
      • cmd.exe (PID: 5736)
      • cmd.exe (PID: 2124)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 6484)
      • cmd.exe (PID: 7656)
      • cmd.exe (PID: 4028)
      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 1340)
      • cmd.exe (PID: 6580)
      • cmd.exe (PID: 412)
      • cmd.exe (PID: 8188)
      • cmd.exe (PID: 7404)
      • cmd.exe (PID: 7448)
      • cmd.exe (PID: 7512)
      • cmd.exe (PID: 6552)
      • cmd.exe (PID: 4476)
      • cmd.exe (PID: 6728)
      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 7576)
      • cmd.exe (PID: 1976)
      • cmd.exe (PID: 2124)
      • cmd.exe (PID: 5628)
      • cmd.exe (PID: 5604)
      • cmd.exe (PID: 2460)
      • cmd.exe (PID: 7768)
      • cmd.exe (PID: 3464)
      • cmd.exe (PID: 5016)
      • cmd.exe (PID: 7332)
      • cmd.exe (PID: 2912)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 2460)
      • cmd.exe (PID: 6444)
      • cmd.exe (PID: 2864)
      • cmd.exe (PID: 4864)
      • cmd.exe (PID: 496)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 356)
      • cmd.exe (PID: 5996)
      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 2232)
      • cmd.exe (PID: 6212)
      • cmd.exe (PID: 6532)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 4780)
      • cmd.exe (PID: 5628)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 2284)
      • cmd.exe (PID: 7556)
      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 1412)
      • cmd.exe (PID: 1172)
      • cmd.exe (PID: 2488)
      • cmd.exe (PID: 4788)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 6504)
      • cmd.exe (PID: 7792)
      • cmd.exe (PID: 1176)
      • cmd.exe (PID: 8152)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 2420)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 3204)
      • cmd.exe (PID: 7404)
      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 4700)
      • cmd.exe (PID: 4992)
      • cmd.exe (PID: 4624)
      • cmd.exe (PID: 7076)
      • cmd.exe (PID: 7624)
      • cmd.exe (PID: 3348)
      • cmd.exe (PID: 7364)
      • cmd.exe (PID: 4144)
      • cmd.exe (PID: 8048)
      • cmd.exe (PID: 1188)
      • cmd.exe (PID: 2400)
      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 6456)
      • cmd.exe (PID: 7648)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 7708)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 3348)
      • cmd.exe (PID: 7352)
      • cmd.exe (PID: 2372)
      • cmd.exe (PID: 7804)
      • cmd.exe (PID: 948)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 6000)
      • cmd.exe (PID: 8164)
      • cmd.exe (PID: 7624)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 6236)
      • cmd.exe (PID: 5828)
      • cmd.exe (PID: 7448)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 1848)
      • cmd.exe (PID: 7364)
      • cmd.exe (PID: 7576)
      • cmd.exe (PID: 6456)
      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 4624)
      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 2392)

    • There is functionality for taking screenshot (YARA)

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • Process drops legitimate windows executable

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)

    • Executable content was dropped or overwritten

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)

    • Starts CMD.EXE for commands execution

      • Zelyanor.exe (PID: 8068)
      • python.exe (PID: 5512)
      • python.exe (PID: 7756)
      • python.exe (PID: 2432)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 2416)
      • net.exe (PID: 7548)

    • Cryptography encrypted command line is found

      • cmd.exe (PID: 7572)
      • powershell.exe (PID: 4212)
      • powershell.exe (PID: 7636)
      • cmd.exe (PID: 2900)

    • Application launched itself

      • Zelyanor.exe (PID: 8068)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 7572)

    • Obfuscation pattern (POWERSHELL)

      • powershell.exe (PID: 7636)
      • powershell.exe (PID: 4212)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 7572)

    • Uses TASKKILL.EXE to kill Browsers

      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 5604)
      • cmd.exe (PID: 1524)
      • cmd.exe (PID: 4404)
      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 1112)
      • cmd.exe (PID: 7356)
      • cmd.exe (PID: 6664)
      • cmd.exe (PID: 7036)
      • cmd.exe (PID: 7120)
      • cmd.exe (PID: 2364)
      • cmd.exe (PID: 5336)
      • cmd.exe (PID: 6296)
      • cmd.exe (PID: 7884)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 6188)
      • cmd.exe (PID: 5736)
      • cmd.exe (PID: 6320)
      • cmd.exe (PID: 3692)
      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 7520)
      • cmd.exe (PID: 7108)
      • cmd.exe (PID: 7944)
      • cmd.exe (PID: 4292)
      • cmd.exe (PID: 6096)
      • cmd.exe (PID: 3204)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 7772)
      • cmd.exe (PID: 4340)
      • cmd.exe (PID: 4624)
      • cmd.exe (PID: 1984)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 5160)
      • cmd.exe (PID: 2712)
      • cmd.exe (PID: 7288)
      • cmd.exe (PID: 7396)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 7444)
      • cmd.exe (PID: 1112)
      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 3348)
      • cmd.exe (PID: 7600)
      • cmd.exe (PID: 7260)
      • cmd.exe (PID: 1176)
      • cmd.exe (PID: 7868)

    • Possible stealing of messenger data

      • Zelyanor.exe (PID: 8068)

    • The process drops C-runtime libraries

      • Zelyanor.exe (PID: 8068)

    • Process drops python dynamic module

      • Zelyanor.exe (PID: 8068)

    • Loads Python modules

      • python.exe (PID: 2432)
      • python.exe (PID: 7756)
      • python.exe (PID: 5512)
      • python.exe (PID: 3060)

  • INFO

    • The sample compiled with english language support

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)

    • Checks supported languages

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)
      • Zelyanor.exe (PID: 6592)
      • Zelyanor.exe (PID: 7024)
      • python.exe (PID: 5512)
      • python.exe (PID: 2432)
      • python.exe (PID: 7756)
      • python.exe (PID: 3060)
      • Zelyanor.exe (PID: 5336)

    • Create files in a temporary directory

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)
      • python.exe (PID: 2432)
      • python.exe (PID: 5512)
      • python.exe (PID: 7756)

    • Reads the computer name

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)
      • Zelyanor.exe (PID: 6592)
      • Zelyanor.exe (PID: 7024)
      • python.exe (PID: 2432)
      • python.exe (PID: 7756)
      • python.exe (PID: 5512)
      • Zelyanor.exe (PID: 5336)

    • Creates files or folders in the user directory

      • ZelyanorSetup1.0.0.exe (PID: 7832)
      • Zelyanor.exe (PID: 8068)
      • Zelyanor.exe (PID: 6592)
      • Zelyanor.exe (PID: 5336)

    • Creates a software uninstall entry

      • ZelyanorSetup1.0.0.exe (PID: 7832)

    • Manual execution by a user

      • Zelyanor.exe (PID: 7924)
      • Zelyanor.exe (PID: 8068)

    • Reads product name

      • Zelyanor.exe (PID: 8068)

    • Reads Environment values

      • Zelyanor.exe (PID: 8068)

    • Process checks computer location settings

      • Zelyanor.exe (PID: 8068)

    • Checks proxy server information

      • Zelyanor.exe (PID: 8068)
      • python.exe (PID: 7756)
      • python.exe (PID: 2432)
      • python.exe (PID: 5512)
      • slui.exe (PID: 7312)

    • Node.js compiler has been detected

      • Zelyanor.exe (PID: 8068)

    • Python executable

      • python.exe (PID: 2432)
      • python.exe (PID: 5512)
      • python.exe (PID: 7756)
      • python.exe (PID: 3060)

    • Reads the machine GUID from the registry

      • python.exe (PID: 5512)
      • python.exe (PID: 2432)
      • python.exe (PID: 7756)
      • python.exe (PID: 3060)
      • Zelyanor.exe (PID: 5336)

    • Checks operating system version

      • python.exe (PID: 5512)
      • python.exe (PID: 7756)
      • python.exe (PID: 2432)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • python.exe (PID: 5512)
      • python.exe (PID: 2432)
      • python.exe (PID: 7756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Fallik
FileDescription: Setup of Velyanor game.
FileVersion: 1.0.0
LegalCopyright: Copyright © 2026 Fallik
ProductName: Zelyanor
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 130
Monitored processes
1 000
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start zelyanorsetup1.0.0.exe zelyanor.exe no specs #SILENTSTEALER zelyanor.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs zelyanor.exe no specs zelyanor.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs slui.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs python.exe conhost.exe no specs python.exe conhost.exe no specs python.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs python.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs zelyanor.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
144taskkill /F /IM taskmgr.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
144taskkill /F /IM taskmgr.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
144\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
356C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"C:\Windows\System32\cmd.exe—Zelyanor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
412\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
412C:\WINDOWS\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"C:\Windows\System32\cmd.exe—Zelyanor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
412taskkill /F /IM taskmgr.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
51 038
Read events
51 007
Write events
13
Delete events
18

Modification events

(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\Zelyanor
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:ShortcutName
Value:
Zelyanor
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:DisplayName
Value:
Zelyanor 1.0.0
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\Zelyanor\Uninstall Zelyanor.exe" /currentuser
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\Zelyanor\Uninstall Zelyanor.exe" /currentuser /S
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:DisplayVersion
Value:
1.0.0
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\Zelyanor\Zelyanor.exe,0
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:Publisher
Value:
Fallik
(PID) Process:(7832) ZelyanorSetup1.0.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\a88536c9-01c5-5bf9-80fd-a719f0683ae1
Operation:writeName:NoModify
Value:
1
Executable files
83
Suspicious files
2 612
Text files
1 733
Unknown types
0

Dropped files

PID
Process
Filename
Type
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\app-64.7z —
MD5:—
SHA256:—
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\SpiderBanner.dllexecutable
MD5:17309E33B596BA3A5693B4D3E85CF8D7
SHA256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\nsis7z.dllexecutable
MD5:80E44CE4895304C6A3A831310FBF8CD0
SHA256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\StdUtils.dllexecutable
MD5:C6A6E03F77C313B267498515488C5740
SHA256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\7z-out\LICENSE.electron.txttext
MD5:4D42118D35941E0F664DDDBD83F633C5
SHA256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\7z-out\locales\bg.pakbinary
MD5:9DC95C3B9B47CC9FE5A34B2AAB2D4D01
SHA256:FC4A59EA60D04B224765BE4916090E97ED8DDDA6B136A92A3827ED0FCC64BB0E
7832ZelyanorSetup1.0.0.exeC:\Users\admin\AppData\Local\Temp\nsnC76.tmp\7z-out\locales\ar.pakbinary
MD5:98F8A48892B41E64BEF135B86F3D4A6C
SHA256:E34D5CABAED4634C672591074057C12947BC9E728004228A9E75F87829F4A48A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
42
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2952
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
2952
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
—
—
GET
200
2.16.206.133:443
https://globalcdn.nuget.org/packages/python.3.10.0.nupkg
unknown
binary
13.6 Mb
unknown
7440
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
7312
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
—
—
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
unknown
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2952
svchost.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2952
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
8068
Zelyanor.exe
23.2.13.144:443
globalcdn.nuget.org
AKAMAI-ASN1
NL
whitelisted
7440
slui.exe
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2432
python.exe
151.101.64.223:443
pypi.org
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
globalcdn.nuget.org
  • 23.2.13.144
  • 23.2.13.138
whitelisted
self.events.data.microsoft.com
  • 20.189.173.8
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
  • 48.192.1.65
whitelisted
pypi.org
  • 151.101.64.223
  • 151.101.192.223
  • 151.101.128.223
  • 151.101.0.223
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZelyanorSetup1.0.0.exe