rms | 914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05

Analysis

max time kernel
159s
max time network
174s
platform
windows7_x64
resource
win7-en-20211208
submitted
13-02-2022 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe
Size

3.4MB
MD5

40062563fe3f83903c858414577adb36
SHA1

3f86f294231a57bf67ea308b64be294558719669
SHA256

914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05
SHA512

b92c3ad3710df01e31fd675b6143921a9ea642b97a5f60c39df2306c0679d871f8ee0e377df079e882a7f378ef421b79a2b5947b95ff4f275cca8260766445b9

Score

10^/10

rms evasion persistence rat trojan upx

Malware Config

Signatures

RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
trojan rat rms

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000013052-84.dat	acprotect
behavioral1/files/0x00060000000131fe-106.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1512	data.exe
804	Nethost.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000013052-84.dat	upx
behavioral1/files/0x00060000000131fe-106.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe
1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe
1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe
1044	cmd.exe
1044	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Services = "C:Net\\Nethost.exe"	reg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\4w5tb68h7t987093f4trq893f4rw89etw.txt	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1348	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
836	tasklist.exe
1516	tasklist.exe
1156	tasklist.exe
1712	tasklist.exe
1568	tasklist.exe
1044	tasklist.exe
520	tasklist.exe
1892	tasklist.exe
1700	tasklist.exe
1416	tasklist.exe
1156	tasklist.exe
1996	tasklist.exe
944	tasklist.exe
808	tasklist.exe
944	tasklist.exe
1396	tasklist.exe
1940	tasklist.exe
1560	tasklist.exe
1660	tasklist.exe
364	tasklist.exe
1480	tasklist.exe
1544	tasklist.exe
1396	tasklist.exe
1596	tasklist.exe
1488	tasklist.exe
1112	tasklist.exe
1112	tasklist.exe
1720	tasklist.exe
564	tasklist.exe
1100	tasklist.exe
1700	tasklist.exe
1724	tasklist.exe
760	tasklist.exe
1348	tasklist.exe
1692	tasklist.exe
1396	tasklist.exe
1700	tasklist.exe
1156	tasklist.exe
780	tasklist.exe
1040	tasklist.exe
1756	tasklist.exe
1044	tasklist.exe
1692	tasklist.exe
1108	tasklist.exe
1816	tasklist.exe
752	tasklist.exe
1816	tasklist.exe
1440	tasklist.exe
1664	tasklist.exe
1396	tasklist.exe
1964	tasklist.exe
1092	tasklist.exe
1480	tasklist.exe
1432	Process not Found
548	tasklist.exe
468	tasklist.exe
944	tasklist.exe
760	tasklist.exe
1080	tasklist.exe
1488	tasklist.exe
1288	tasklist.exe
808	tasklist.exe
1724	tasklist.exe
1156	tasklist.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
868	taskkill.exe
1880	taskkill.exe
1572	taskkill.exe
1480	taskkill.exe
324	taskkill.exe
1940	taskkill.exe

Runs .reg file with regedit 1 IoCs

pid	Process
276	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
804	Nethost.exe
804	Nethost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	1480	taskkill.exe
Token: SeTakeOwnershipPrivilege	804	Nethost.exe
Token: SeTcbPrivilege	804	Nethost.exe
Token: SeTcbPrivilege	804	Nethost.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	1156	tasklist.exe
Token: SeDebugPrivilege	1044	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	1156	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	1156	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	1436	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	1156	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	652	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	1100	tasklist.exe
Token: SeDebugPrivilege	1564	tasklist.exe
Token: SeDebugPrivilege	808	tasklist.exe
Token: SeDebugPrivilege	652	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1016	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	Nethost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1656 wrote to memory of 1512	1656	914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe	27
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1512 wrote to memory of 1648	1512	data.exe	28
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 564	1648	WScript.exe	29
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 380	1648	WScript.exe	30
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 1648 wrote to memory of 1516	1648	WScript.exe	31
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 564 wrote to memory of 1044	564	wscript.exe	32
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1100	1044	cmd.exe	34
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 1924	1044	cmd.exe	35
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 324	1044	cmd.exe	38
PID 1044 wrote to memory of 1940	1044	cmd.exe	40

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1100	attrib.exe
380	attrib.exe
1972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe
"C:\Users\Admin\AppData\Local\Temp\914713080748f8ab3d56b32b50eaab459cc36d1f539a9fc49c382542809bfd05.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows\build\data.exe" -p284579G45398T745398T
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Log\Windows\hiscomponent\install.bat" "
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1044
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Log"
        6⤵
        Views/modifies file attributes
        
        PID:1100
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set allprofiles state off
        6⤵
        
        PID:1924
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rutserv.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im rfusclient.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im systemc.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:868
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im drivemanag.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dumprep.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im winlogs.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\SYSTEM\Remote Manipulator System" /f
        6⤵
        
        PID:1416
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f
        6⤵
        
        PID:1196
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System" /f
        6⤵
        
        PID:556
      - C:\Windows\SysWOW64\regedit.exe
        
        regedit /s "Windows\hiscomponent\regedit.reg"
        6⤵
        Runs .reg file with regedit
        
        PID:276
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:1348
      - C:\Net\Nethost.exe
        
        Nethost.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Windows\SysWOW64\reg.exe
        
        Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Services" /t REG_SZ /d "C:Net\Nethost.exe" /f
        6⤵
        Adds Run key to start application
        
        PID:744
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Net\*.*"
        6⤵
        Views/modifies file attributes
        
        PID:380
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Net"
        6⤵
        Views/modifies file attributes
        
        PID:1972
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Net\process.vbs"
        6⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Net\process.bat" "
        7⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:652
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:652
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:960
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:836
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1348
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:836
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1660
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:564
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:652
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:808
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1100
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:364
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:908
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:808
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1664
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:808
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:836
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:908
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1816
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1544
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1712
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:840
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1080
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1596
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1568
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1156
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:640
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:608
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:780
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1964
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:652
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1940
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1996
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1112
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1092
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:960
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:652
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:960
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:872
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:652
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:960
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:760
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:548
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:952
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1108
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:908
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:972
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:276
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:944
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:772
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:908
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1416
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1816
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:1044
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:944
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:564
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:908
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:568
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:780
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:380
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:948
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:956
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:752
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:364
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:780
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:268
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:520
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\find.exe
        
        find "Nethost.exe"
        8⤵
        
        PID:956
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Log\install.vbs" Run
      4⤵
      PID:1516