# Windows Pains 3![Category](http://img.shields.io/badge/Category-Forensics-orange?style=for-the-badge) ![Points](http://img.shields.io/badge/Points-100-brightgreen?style=for-the-badge)
## Details
One of De Monne's employees had their personal Windows computer hacked by a member of DEADFACE. The attacker managed to exploit a portion of a database backup that contains sensitive employee and customer PII.
> Using the [memory dump file](https://tinyurl.com/wcekj3rt) from Window Pains, find out the name of the malicious process.>> Submit the flag as `flag{process-name_pid}` (include the extension)..>> Example: `flag{svchost.exe_1234}`---
Using Volatility3 we run `sudo python3 vol.py -f physmemraw windows.pstree`
```❯ sudo python3 /opt/volatility3/vol.py -f physmemraw windows.pstreeVolatility 3 Framework 2.0.0Progress:  100.00               PDB scanning finished                        PID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime
4       0       System  0x9a077de79040  116     -       N/A     False   2021-09-07 14:24:34.000000      N/A* 372   4       smss.exe        0x9a077eacc040  2       -       N/A     False   2021-09-07 14:24:34.000000      N/A* 108   4       Registry        0x9a077dfc8040  4       -       N/A     False   2021-09-07 14:24:29.000000      N/A* 1868  4       MemCompression  0x9a0780c24080  42      -       N/A     False   2021-09-07 14:24:56.000000      N/A468     456     csrss.exe       0x9a077f2db140  11      -       0       False   2021-09-07 14:24:53.000000      N/A544     536     csrss.exe       0x9a077fe9e140  12      -       1       False   2021-09-07 14:24:53.000000      N/A568     456     wininit.exe     0x9a077fead080  1       -       0       False   2021-09-07 14:24:53.000000      N/A* 864   568     fontdrvhost.ex  0x9a077ff54140  5       -       0       False   2021-09-07 14:24:55.000000      N/A* 708   568     lsass.exe       0x9a077ff1d080  13      -       0       False   2021-09-07 14:24:55.000000      N/A* 668   568     services.exe    0x9a077fedd080  9       -       0       False   2021-09-07 14:24:55.000000      N/A** 1540 668     svchost.exe     0x9a0780af7300  7       -       0       False   2021-09-07 14:24:56.000000      N/A** 2564 668     spoolsv.exe     0x9a0780e8b0c0  7       -       0       False   2021-09-07 14:24:57.000000      N/A** 2056 668     svchost.exe     0x9a0780cd92c0  7       -       0       False   2021-09-07 14:24:57.000000      N/A** 3084 668     svchost.exe     0x9a078408b240  5       -       0       False   2021-09-07 14:24:57.000000      N/A** 1044 668     svchost.exe     0x9a078090e300  32      -       0       False   2021-09-07 14:24:56.000000      N/A** 1556 668     svchost.exe     0x9a0780c88080  5       -       0       False   2021-09-07 14:24:57.000000      N/A** 1564 668     svchost.exe     0x9a0780b35280  3       -       0       False   2021-09-07 14:24:56.000000      N/A** 5152 668     svchost.exe     0x9a0784b10300  8       -       1       False   2021-09-07 14:25:13.000000      N/A** 2552 668     svchost.exe     0x9a0780e93300  11      -       0       False   2021-09-07 14:24:57.000000      N/A** 3112 668     svchost.exe     0x9a078408d2c0  4       -       0       False   2021-09-07 14:24:57.000000      N/A** 2096 668     svchost.exe     0x9a0780ce1300  5       -       0       False   2021-09-07 14:24:57.000000      N/A** 2612 668     svchost.exe     0x9a0780e8f0c0  13      -       0       False   2021-09-07 14:24:57.000000      N/A** 2104 668     svchost.exe     0x9a078405f080  7       -       0       False   2021-09-07 14:24:57.000000      N/A** 1092 668     svchost.exe     0x9a0780c872c0  6       -       0       False   2021-09-07 14:24:57.000000      N/A** 1612 668     svchost.exe     0x9a0780b85300  2       -       0       False   2021-09-07 14:24:56.000000      N/A** 1620 668     MsMpEng.exe     0x9a0784061340  12      -       0       False   2021-09-07 14:24:57.000000      N/A** 4180 668     svchost.exe     0x9a0784750080  7       -       0       False   2021-09-07 14:25:07.000000      N/A** 10840        668     svchost.exe     0x9a0784698080  12      -       0       False   2021-09-07 14:50:38.000000      N/A** 1116 668     svchost.exe     0x9a0780942280  3       -       0       False   2021-09-07 14:24:56.000000      N/A** 2148 668     svchost.exe     0x9a0780dc12c0  8       -       0       False   2021-09-07 14:24:57.000000      N/A** 1656 668     svchost.exe     0x9a0780b472c0  5       -       0       False   2021-09-07 14:24:56.000000      N/A** 1664 668     svchost.exe     0x9a0780b49280  7       -       0       False   2021-09-07 14:24:56.000000      N/A** 4224 668     svchost.exe     0x9a0784792240  9       -       0       False   2021-09-07 14:25:07.000000      N/A** 1168 668     svchost.exe     0x9a0780952240  9       -       0       False   2021-09-07 14:24:56.000000      N/A*** 4732        1168    taskhostw.exe   0x9a07848e72c0  0       -       1       False   2021-09-07 14:25:12.000000      2021-09-07 14:25:12.000000 *** 4564        1168    taskhostw.exe   0x9a078487a340  11      -       1       False   2021-09-07 14:25:12.000000      N/A** 8336 668     svchost.exe     0x9a0785547080  4       -       0       False   2021-09-07 14:26:59.000000      N/A** 9872 668     svchost.exe     0x9a078651c300  0       -       0       False   2021-09-07 14:29:57.000000      2021-09-07 14:30:05.000000 ** 2200 668     svchost.exe     0x9a0780dea300  18      -       0       False   2021-09-07 14:24:57.000000      N/A** 1692 668     svchost.exe     0x9a0780bb1240  3       -       0       False   2021-09-07 14:24:56.000000      N/A** 2208 668     svchost.exe     0x9a0780de80c0  4       -       0       False   2021-09-07 14:24:57.000000      N/A** 2216 668     svchost.exe     0x9a0780dec2c0  6       -       0       False   2021-09-07 14:24:57.000000      N/A** 5300 668     SearchIndexer.  0x9a07848ea080  32      -       0       False   2021-09-07 14:25:14.000000      N/A*** 5864        5300    SearchFilterHo  0x9a0784d4d080  4       -       0       False   2021-09-07 14:56:16.000000      N/A*** 10500       5300    SearchProtocol  0x9a0784e560c0  6       -       0       False   2021-09-07 14:53:47.000000      N/A** 1220 668     svchost.exe     0x9a0780965240  4       -       0       False   2021-09-07 14:24:56.000000      N/A** 6340 668     svchost.exe     0x9a07851d42c0  3       -       0       False   2021-09-07 14:25:22.000000      N/A** 9428 668     svchost.exe     0x9a078514b080  7       -       0       False   2021-09-07 14:32:03.000000      N/A** 8412 668     SgrmBroker.exe  0x9a0785760080  7       -       0       False   2021-09-07 14:26:59.000000      N/A** 1256 668     svchost.exe     0x9a07809c22c0  3       -       0       False   2021-09-07 14:24:56.000000      N/A** 8696 668     svchost.exe     0x9a0785409080  6       -       1       False   2021-09-07 14:27:01.000000      N/A** 1264 668     svchost.exe     0x9a07809c8300  4       -       0       False   2021-09-07 14:24:56.000000      N/A** 2808 668     svchost.exe     0x9a0780eea2c0  3       -       0       False   2021-09-07 14:24:57.000000      N/A** 1272 668     svchost.exe     0x9a07809ca300  8       -       0       False   2021-09-07 14:24:56.000000      N/A** 5392 668     svchost.exe     0x9a07855e50c0  5       -       0       False   2021-09-07 14:25:39.000000      N/A** 2328 668     svchost.exe     0x9a077de68080  3       -       0       False   2021-09-07 14:24:57.000000      N/A** 10008        668     svchost.exe     0x9a0785ce2080  4       -       0       False   2021-09-07 14:55:12.000000      N/A** 4916 668     svchost.exe     0x9a0784932280  4       -       0       False   2021-09-07 14:25:12.000000      N/A*** 4944        4916    ctfmon.exe      0x9a07848e6280  12      -       1       False   2021-09-07 14:25:12.000000      N/A** 5948 668     svchost.exe     0x9a078553c080  3       -       0       False   2021-09-07 14:55:13.000000      N/A** 832  668     svchost.exe     0x9a077ff82240  28      -       0       False   2021-09-07 14:24:55.000000      N/A*** 5780        832     SearchApp.exe   0x9a0784db8080  72      -       1       False   2021-09-07 14:25:18.000000      N/A*** 4248        832     smartscreen.ex  0x9a07867790c0  16      -       1       False   2021-09-07 14:56:38.000000      N/A*** 9500        832     RuntimeBroker.  0x9a0785c19080  0       -       1       False   2021-09-07 14:27:19.000000      2021-09-07 14:57:54.000000 *** 5664        832     RuntimeBroker.  0x9a0784dd8300  2       -       1       False   2021-09-07 14:25:18.000000      N/A*** 1700        832     RuntimeBroker.  0x9a0785429340  4       -       1       False   2021-09-07 14:27:57.000000      N/A*** 7480        832     TextInputHost.  0x9a078575b300  11      -       1       False   2021-09-07 14:26:17.000000      N/A*** 6844        832     RuntimeBroker.  0x9a078528e080  2       -       1       False   2021-09-07 14:25:30.000000      N/A*** 5564        832     StartMenuExper  0x9a0784bf9080  9       -       1       False   2021-09-07 14:25:16.000000      N/A*** 4156        832     RuntimeBroker.  0x9a077eb17300  6       -       1       False   2021-09-07 14:57:01.000000      N/A*** 6212        832     RuntimeBroker.  0x9a0785162300  4       -       1       False   2021-09-07 14:25:22.000000      N/A*** 9544        832     ShellExperienc  0x9a07866e1080  15      -       1       False   2021-09-07 14:28:49.000000      N/A*** 5200        832     YourPhone.exe   0x9a0784edc080  14      -       1       False   2021-09-07 14:25:20.000000      N/A*** 8020        832     UserOOBEBroker  0x9a0785b4b080  4       -       1       False   2021-09-07 14:28:18.000000      N/A*** 6752        832     RuntimeBroker.  0x9a078528d300  16      -       1       False   2021-09-07 14:25:26.000000      N/A**** 10284      6752    powershell.exe  0x9a0786752300  14      -       1       False   2021-09-07 14:35:13.000000      N/A***** 5860      10284   winpmem_mini_x  0x9a077f3e70c0  1       -       1       False   2021-09-07 14:57:44.000000      N/A***** 10268     10284   conhost.exe     0x9a0786744340  6       -       1       False   2021-09-07 14:35:13.000000      N/A*** 10208       832     WinStore.App.e  0x9a077f7550c0  19      -       1       False   2021-09-07 14:27:53.000000      N/A*** 992 832     WWAHost.exe     0x9a0785443300  50      -       1       False   2021-09-07 14:57:05.000000      N/A*** 3944        832     dllhost.exe     0x9a07855d7300  13      -       1       False   2021-09-07 14:26:17.000000      N/A*** 8044        832     ApplicationFra  0x9a07854c1340  19      -       1       False   2021-09-07 14:26:52.000000      N/A*** 9452        832     RuntimeBroker.  0x9a078677b300  4       -       1       False   2021-09-07 14:28:50.000000      N/A*** 6000        832     RuntimeBroker.  0x9a0784bce080  16      -       1       False   2021-09-07 14:25:19.000000      N/A*** 2928        832     SystemSettings  0x9a077f74d080  17      -       1       False   2021-09-07 14:28:16.000000      N/A*** 5368        832     LockApp.exe     0x9a0784dd9080  13      -       1       False   2021-09-07 14:25:21.000000      N/A*** 10748       832     Calculator.exe  0x9a0785cec340  22      -       1       False   2021-09-07 14:57:01.000000      N/A** 2372 668     svchost.exe     0x9a0780e09080  7       -       0       False   2021-09-07 14:24:57.000000      N/A** 2904 668     svchost.exe     0x9a0780ff4240  5       -       0       False   2021-09-07 14:24:57.000000      N/A** 4444 668     svchost.exe     0x9a07847ed300  11      -       1       False   2021-09-07 14:25:11.000000      N/A** 2912 668     svchost.exe     0x9a0780ff6300  4       -       0       False   2021-09-07 14:24:57.000000      N/A** 2920 668     svchost.exe     0x9a0780ff3080  6       -       0       False   2021-09-07 14:24:57.000000      N/A** 1392 668     svchost.exe     0x9a0780a2e240  8       -       0       False   2021-09-07 14:24:56.000000      N/A*** 4412        1392    sihost.exe      0x9a07844ab080  14      -       1       False   2021-09-07 14:25:11.000000      N/A** 7024 668     SecurityHealth  0x9a0784bb3080  15      -       0       False   2021-09-07 14:25:32.000000      N/A** 3444 668     svchost.exe     0x9a0784236240  3       -       0       False   2021-09-07 14:24:57.000000      N/A** 2936 668     svchost.exe     0x9a0780ff7080  10      -       0       False   2021-09-07 14:24:57.000000      N/A** 4472 668     svchost.exe     0x9a07847ee080  8       -       1       False   2021-09-07 14:25:11.000000      N/A** 1404 668     svchost.exe     0x9a0780a302c0  5       -       0       False   2021-09-07 14:24:56.000000      N/A** 2944 668     svchost.exe     0x9a0780ff8080  16      -       0       False   2021-09-07 14:24:57.000000      N/A** 1412 668     svchost.exe     0x9a0780a32300  5       -       0       False   2021-09-07 14:24:56.000000      N/A** 1924 668     svchost.exe     0x9a0780c2d300  8       -       0       False   2021-09-07 14:24:57.000000      N/A** 904  668     svchost.exe     0x9a07852240c0  10      -       0       False   2021-09-07 14:25:37.000000      N/A** 8584 668     svchost.exe     0x9a0784d8f080  9       -       0       False   2021-09-07 14:27:00.000000      N/A** 1936 668     svchost.exe     0x9a0780c7b240  2       -       0       False   2021-09-07 14:24:57.000000      N/A** 2964 668     svchost.exe     0x9a0784036240  11      -       0       False   2021-09-07 14:24:57.000000      N/A** 10648        668     svchost.exe     0x9a07864c0080  4       -       0       False   2021-09-07 14:32:36.000000      N/A** 5020 668     svchost.exe     0x9a078497a2c0  8       -       0       False   2021-09-07 14:25:12.000000      N/A** 3996 668     svchost.exe     0x9a0784a4d080  6       -       0       False   2021-09-07 14:25:12.000000      N/A** 7584 668     svchost.exe     0x9a07853e12c0  12      -       0       False   2021-09-07 14:26:57.000000      N/A** 4016 668     svchost.exe     0x9a0784471080  8       -       0       False   2021-09-07 14:25:01.000000      N/A** 952  668     svchost.exe     0x9a078083a2c0  16      -       0       False   2021-09-07 14:24:56.000000      N/A** 8656 668     svchost.exe     0x9a0785249080  11      -       0       False   2021-09-07 14:27:00.000000      N/A** 3544 668     svchost.exe     0x9a07846cb240  0       -       0       False   2021-09-07 14:25:06.000000      2021-09-07 14:35:42.000000 ** 7132 668     svchost.exe     0x9a07855f0240  4       -       0       False   2021-09-07 14:25:33.000000      N/A** 9692 668     svchost.exe     0x9a07854ac080  5       -       0       False   2021-09-07 14:28:03.000000      N/A** 4064 668     svchost.exe     0x9a078458e080  5       -       0       False   2021-09-07 14:54:56.000000      N/A** 996  668     svchost.exe     0x9a078085c240  7       -       0       False   2021-09-07 14:24:56.000000      N/A** 3048 668     svchost.exe     0x9a0780ff2280  3       -       0       False   2021-09-07 14:24:57.000000      N/A** 3060 668     svchost.exe     0x9a078405e240  6       -       0       False   2021-09-07 14:24:57.000000      N/A** 2040 668     svchost.exe     0x9a0780c85280  3       -       0       False   2021-09-07 14:24:57.000000      N/A644     536     winlogon.exe    0x9a077fe9c140  3       -       1       False   2021-09-07 14:24:54.000000      N/A* 856   644     fontdrvhost.ex  0x9a077ff89140  5       -       1       False   2021-09-07 14:24:55.000000      N/A* 428   644     dwm.exe 0x9a078087f080  21      -       1       False   2021-09-07 14:24:56.000000      N/A* 384   644     LogonUI.exe     0x9a078087e080  0       -       1       False   2021-09-07 14:24:56.000000      2021-09-07 14:25:29.000000 * 4140  644     userinit.exe    0x9a07849b5080  0       -       1       False   2021-09-07 14:25:12.000000      2021-09-07 14:25:36.000000 ** 4012 4140    explorer.exe    0x9a07849b7340  71      -       1       False   2021-09-07 14:25:12.000000      N/A*** 10432       4012    notepad.exe     0x9a0785775300  6       -       1       False   2021-09-07 14:56:56.000000      N/A*** 1796        4012    powershell.exe  0x9a0785404300  15      -       1       False   2021-09-07 14:29:07.000000      N/A**** 8592       1796    conhost.exe     0x9a0785c11300  5       -       1       False   2021-09-07 14:29:08.000000      N/A*** 1832        4012    powershell_ise  0x9a07862e60c0  23      -       1       False   2021-09-07 14:30:48.000000      N/A**** 10992      1832    conhost.exe     0x9a0784f26080  5       -       1       False   2021-09-07 14:33:01.000000      N/A*** 6988        4012    SecurityHealth  0x9a0784d15080  6       -       1       False   2021-09-07 14:25:32.000000      N/A*** 7120        4012    msedge.exe      0x9a0785297080  0       -       1       False   2021-09-07 14:25:33.000000      2021-09-07 14:56:33.000000 **** 3652       7120    msedge.exe      0x9a0784da7080  36      -       1       False   2021-09-07 14:56:33.000000      N/A***** 7008      3652    msedge.exe      0x9a07851dc080  18      -       1       False   2021-09-07 14:56:34.000000      N/A***** 32        3652    msedge.exe      0x9a07854e7080  17      -       1       False   2021-09-07 14:56:41.000000      N/A***** 3556      3652    msedge.exe      0x9a0785548340  0       -       1       False   2021-09-07 14:56:39.000000      2021-09-07 14:56:46.000000 ***** 420       3652    msedge.exe      0x9a07864f6300  13      -       1       False   2021-09-07 14:56:52.000000      N/A***** 9896      3652    msedge.exe      0x9a0785b1e340  0       -       1       False   2021-09-07 14:56:39.000000      2021-09-07 14:57:44.000000 ***** 5832      3652    msedge.exe      0x9a078428b080  7       -       1       False   2021-09-07 14:57:39.000000      N/A***** 10808     3652    msedge.exe      0x9a0785ad6340  16      -       1       False   2021-09-07 14:56:49.000000      N/A***** 6540      3652    msedge.exe      0x9a0786787340  10      -       1       False   2021-09-07 14:56:51.000000      N/A***** 1996      3652    msedge.exe      0x9a078582b080  15      -       1       False   2021-09-07 14:57:03.000000      N/A***** 2744      3652    msedge.exe      0x9a0785228080  0       -       1       False   2021-09-07 14:57:30.000000      2021-09-07 14:57:40.000000 ***** 6032      3652    msedge.exe      0x9a0785218080  8       -       1       False   2021-09-07 14:56:33.000000      N/A***** 5240      3652    msedge.exe      0x9a0785bd0080  15      -       1       False   2021-09-07 14:57:35.000000      N/A***** 2488      3652    msedge.exe      0x9a0785cb4340  13      -       1       False   2021-09-07 14:56:46.000000      N/A***** 4924      3652    msedge.exe      0x9a0784a66080  7       -       1       False   2021-09-07 14:56:34.000000      N/A***** 1628      3652    msedge.exe      0x9a07854da340  17      -       1       False   2021-09-07 14:56:34.000000      N/A*** 7096        4012    OneDrive.exe    0x9a0785236080  25      -       1       False   2021-09-07 14:25:32.000000      N/A7308    5292    Spotify.exe     0x9a07851dd080  35      -       1       True    2021-09-07 14:25:42.000000      N/A* 7620  7308    Spotify.exe     0x9a07855d0300  6       -       1       True    2021-09-07 14:25:49.000000      N/A* 7908  7308    Spotify.exe     0x9a07856ef2c0  8       -       1       True    2021-09-07 14:25:55.000000      N/A* 7720  7308    Spotify.exe     0x9a0785784080  7       -       1       True    2021-09-07 14:25:50.000000      N/A* 8136  7308    Spotify.exe     0x9a0785bce0c0  12      -       1       True    2021-09-07 14:25:58.000000      N/A* 7896  7308    Spotify.exe     0x9a07847db080  6       -       1       True    2021-09-07 14:25:55.000000      N/A8180    2252    userinit.exe    0x9a07843ab080  3       -       1       True    2021-09-07 14:55:55.000000      N/A
```
Next we also run ; `sudo python3 vol.py -f physmemraw windows.cmdLine`
```❯ sudo python3 /opt/volatility3/vol.py -f physmemraw windows.cmdlineVolatility 3 Framework 2.0.0Progress:  100.00               PDB scanning finished                        PID     Process Args
4       System  Required memory at 0x20 is not valid (process exited?)108     Registry        Required memory at 0x20 is not valid (process exited?)372     smss.exe        \SystemRoot\System32\smss.exe468     csrss.exe       %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16544     csrss.exe       %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16568     wininit.exe     wininit.exe644     winlogon.exe    winlogon.exe668     services.exe    C:\WINDOWS\system32\services.exe708     lsass.exe       C:\WINDOWS\system32\lsass.exe832     svchost.exe     C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p856     fontdrvhost.ex  Required memory at 0x1bcfe071a28 is inaccessible (swapped)864     fontdrvhost.ex  Required memory at 0x1fbf9d01a28 is inaccessible (swapped)952     svchost.exe     C:\WINDOWS\system32\svchost.exe -k RPCSS -p996     svchost.exe     C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSM384     LogonUI.exe     Required memory at 0x29d6860020 is not valid (process exited?)428     dwm.exe "dwm.exe"1044    svchost.exe     C:\WINDOWS\System32\svchost.exe -k NetworkService -s TermService1116    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1168    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule1220    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ProfSvc1256    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p1264    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1272    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1392    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UserManager1404    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s nsi1412    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1540    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1564    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s UmRdpService1612    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1656    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s EventSystem1664    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain1692    svchost.exe     C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s Themes1868    MemCompression  Required memory at 0x20 is not valid (process exited?)1924    svchost.exe     C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s NlaSvc1936    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s SENS2040    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1092    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s FontCache1556    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -s CertPropSvc2056    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p2096    svchost.exe     C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation2148    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalService -p -s netprofm2200    svchost.exe     C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache2208    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p2216    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p2328    svchost.exe     C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s ShellHWDetection2372    svchost.exe     C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s SessionEnv2552    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc2564    spoolsv.exe     Required memory at 0x12e1ae8 is inaccessible (swapped)2612    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p2808    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p2904    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s IKEEXT2912    svchost.exe     C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent2920    svchost.exe     C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s CryptSvc2936    svchost.exe     C:\WINDOWS\System32\svchost.exe -k utcsvc -p2944    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS2964    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Winmgmt3048    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks3060    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s LanmanServer2104    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnService1620    MsMpEng.exe     "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2107.4-0\MsMpEng.exe"3084    svchost.exe     C:\WINDOWS\System32\svchost.exe -k NetSvcs -p -s iphlpsvc3112    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalService -p -s WdiServiceHost3444    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s lfsvc4016    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManager3544    svchost.exe     Required memory at 0xdbe6836020 is not valid (process exited?)4180    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s TokenBroker4224    svchost.exe     C:\WINDOWS\system32\svchost.exe -k appmodel -p -s StateRepository4412    sihost.exe      sihost.exe4444    svchost.exe     C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc4472    svchost.exe     C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService4564    taskhostw.exe   taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}4732    taskhostw.exe   Required memory at 0xb6a8430020 is not valid (process exited?)4916    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService4944    ctfmon.exe      "ctfmon.exe"5020    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s CDPSvc4140    userinit.exe    Required memory at 0xfd21197020 is not valid (process exited?)4012    explorer.exe    C:\WINDOWS\Explorer.EXE3996    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc5152    svchost.exe     C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc5300    SearchIndexer.  C:\WINDOWS\system32\SearchIndexer.exe /Embedding5564    StartMenuExper  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca5664    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding5780    SearchApp.exe   "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca6000    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding5200    YourPhone.exe   "C:\Program Files\WindowsApps\Microsoft.YourPhone_1.21072.160.0_x64__8wekyb3d8bbwe\YourPhone.exe" -ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca5368    LockApp.exe     "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7amqjywdat7d3j2z.mca6212    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding6340    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalService -p -s BthAvctpSvc6752    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding6844    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding6988    SecurityHealth  "C:\Windows\System32\SecurityHealthSystray.exe" 7024    SecurityHealth  C:\WINDOWS\system32\SecurityHealthService.exe7096    OneDrive.exe    "C:\Users\Jimmie\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background7120    msedge.exe      Required memory at 0x5f397ad020 is not valid (process exited?)7132    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Appinfo904     svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc5392    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost7308    Spotify.exe     Spotify.exe --autostart7620    Spotify.exe     "C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\Spotify.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Jimmie\AppData\Local\SpotifyAppX\User Data\Crashpad" "--metrics-dir=C:\Users\Jimmie\AppData\Local\SpotifyAppX\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.67.586 --initial-client-data=0x5d0,0x5cc,0x5a0,0x5c8,0x5d4,0x6c433a28,0x6c433a38,0x6c433a447720    Spotify.exe     "C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\Spotify.exe" --type=gpu-process --field-trial-handle=2108,4839584854497019253,9112382588695800992,131072 --disable-features=CalculateNativeWinOcclusion --disable-d3d11 --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --log-severity=disable --user-agent-product="Chrome/91.0.4472.114 Spotify/1.1.67.586" --lang=en --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --mojo-platform-channel-handle=2112 /prefetch:27896    Spotify.exe     "C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4839584854497019253,9112382588695800992,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --log-severity=disable --user-agent-product="Chrome/91.0.4472.114 Spotify/1.1.67.586" --lang=en --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --mojo-platform-channel-handle=3096 /prefetch:87908    Spotify.exe     "C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4839584854497019253,9112382588695800992,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=none --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --log-severity=disable --user-agent-product="Chrome/91.0.4472.114 Spotify/1.1.67.586" --lang=en --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --mojo-platform-channel-handle=3252 /prefetch:88136    Spotify.exe     "C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\Spotify.exe" --type=renderer --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --field-trial-handle=2108,4839584854497019253,9112382588695800992,131072 --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.167.586.0_x86__zpdnekdrzrea0\debug.log" --log-severity=disable --user-agent-product="Chrome/91.0.4472.114 Spotify/1.1.67.586" --disable-spell-checking --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3532 /prefetch:17480    TextInputHost.  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca3944    dllhost.exe     C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}8044    ApplicationFra  C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding7584    svchost.exe     C:\WINDOWS\System32\svchost.exe -k NetworkService -p -s DoSvc8336    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc8412    SgrmBroker.exe  C:\WINDOWS\system32\SgrmBroker.exe8584    svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s UsoSvc8656    svchost.exe     C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc8696    svchost.exe     C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup9500    RuntimeBroker.  Required memory at 0x188c83a020 is not valid (process exited?)10208   WinStore.App.e  "C:\Program Files\WindowsApps\Microsoft.WindowsStore_12107.1001.15.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca1700    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding9692    svchost.exe     C:\WINDOWS\System32\svchost.exe -k netsvcs -p2928    SystemSettings  "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel8020    UserOOBEBroker  C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding9544    ShellExperienc  "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca9452    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding1796    powershell.exe  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 8592    conhost.exe     \??\C:\WINDOWS\system32\conhost.exe 0x49872    svchost.exe     Required memory at 0x3b47875020 is not valid (process exited?)1832    powershell_ise  "C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell_ISE.exe" 9428    svchost.exe     C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV10648   svchost.exe     C:\WINDOWS\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc10992   conhost.exe     \??\C:\WINDOWS\system32\conhost.exe 0x410284   powershell.exe  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 10268   conhost.exe     \??\C:\WINDOWS\system32\conhost.exe 0x410840   svchost.exe     C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauserv10500   SearchProtocol  "C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" 4064    svchost.exe     C:\WINDOWS\system32\svchost.exe -k appmodel -p -s camsvc10008   svchost.exe     C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc5948    svchost.exe     C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC8180    userinit.exe    C:\Windows\Temp\userinit.exe5864    SearchFilterHo  "C:\WINDOWS\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784 3652    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window /prefetch:56032    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Jimmie\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Jimmie\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=93.0.4577.63 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=93.0.961.38 --initial-client-data=0xf0,0xf4,0xf8,0xcc,0xfc,0x7ff88f5076c8,0x7ff88f5076d8,0x7ff88f5076e87008    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:21628    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:34924    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:84248    smartscreen.ex  C:\Windows\System32\smartscreen.exe -Embedding3556    msedge.exe      Required memory at 0xac6f8ee020 is not valid (process exited?)9896    msedge.exe      Required memory at 0xa9810be020 is not valid (process exited?)32      msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12488    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:110808   msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:16540    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6256 /prefetch:8420     msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:110432   notepad.exe     "C:\WINDOWS\system32\notepad.exe" 10748   Calculator.exe  "C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca4156    RuntimeBroker.  C:\Windows\System32\RuntimeBroker.exe -Embedding1996    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1992     WWAHost.exe     "C:\Windows\system32\wwahost.exe" -ServerName:OfficeHubHWA.wwa2744    msedge.exe      Required memory at 0xc7569f5020 is not valid (process exited?)5240    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:15832    msedge.exe      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2052,8545982222989981453,14056150474032184914,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=7408 /prefetch:85860    winpmem_mini_x  "C:\Users\Jimmie\Downloads\winpmem_mini_x64_rc2.exe" physmemraw
```
One line that looks odd is;
```8180    userinit.exe    C:\Windows\Temp\userinit.exe```
You can see that this process is running from the `C:\Windows\Temp` directory, which is a little odd!
We took a guess on this as it seemed suspicious and it paid off... the flag was;
## flag{userinit.exe_8180}