a799783600bfc7c93074b7eace12f1ba2aed930e2beb67388e5b2158fe0b5ef6

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

freddurstpayload.bat
Size

796B
MD5

fda90e4c5a003ed7bf37e3c512149769
SHA1

2d4cf75ab93ea71bea58b79da6e5d6a8e228f20c
SHA256

1c3dee110048993597620155de179558f7121ada6390d843cb7d33a5dd26887a
SHA512

f05def505afc994d7200d14d50d4cf1b8d741ce408638b448220cd663f2c562f36f39676b352b2fd898104ef0e0df6833e8f44dbbb4be6488d2f29463b5726ce

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1704	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
1000	timeout.exe
2744	timeout.exe
1568	timeout.exe
1912	timeout.exe
3036	timeout.exe
112	timeout.exe
1700	timeout.exe
2292	timeout.exe
2944	timeout.exe
4088	timeout.exe
1156	timeout.exe
2988	timeout.exe
2624	timeout.exe
2552	timeout.exe
3044	timeout.exe
980	timeout.exe
1968	timeout.exe
2256	timeout.exe
3168	timeout.exe
1964	timeout.exe
904	timeout.exe
2004	timeout.exe
936	timeout.exe
4012	timeout.exe
3508	timeout.exe
2712	timeout.exe
1928	timeout.exe
980	timeout.exe
1928	timeout.exe
2592	timeout.exe
1988	timeout.exe
1796	timeout.exe
3156	timeout.exe
1932	timeout.exe
3064	timeout.exe
896	timeout.exe
692	timeout.exe
824	timeout.exe
1532	timeout.exe
984	timeout.exe
2968	timeout.exe
3440	timeout.exe
3412	timeout.exe
3704	timeout.exe
3280	timeout.exe
1552	timeout.exe
584	timeout.exe
2868	timeout.exe
2460	timeout.exe
1404	timeout.exe
2392	timeout.exe
2256	timeout.exe
1968	timeout.exe
1364	timeout.exe
2916	timeout.exe
1932	timeout.exe
3732	timeout.exe
2112	timeout.exe
2604	timeout.exe
1828	timeout.exe
3096	timeout.exe
600	timeout.exe
1528	timeout.exe
2448	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
536	tasklist.exe
868	tasklist.exe
2616	tasklist.exe
2564	tasklist.exe
3056	tasklist.exe
2416	tasklist.exe
2504	tasklist.exe
824	tasklist.exe
1932	tasklist.exe
928	tasklist.exe
3756	tasklist.exe
4036	tasklist.exe
2104	tasklist.exe
2320	tasklist.exe
2864	tasklist.exe
904	tasklist.exe
2180	tasklist.exe
904	tasklist.exe
2524	tasklist.exe
4032	tasklist.exe
896	tasklist.exe
2212	tasklist.exe
1364	tasklist.exe
4056	tasklist.exe
2204	tasklist.exe
1700	tasklist.exe
2208	tasklist.exe
884	tasklist.exe
3044	tasklist.exe
3680	tasklist.exe
668	tasklist.exe
2924	tasklist.exe
2100	tasklist.exe
2464	tasklist.exe
1956	tasklist.exe
1700	tasklist.exe
2196	tasklist.exe
1944	tasklist.exe
1628	tasklist.exe
2212	tasklist.exe
3536	tasklist.exe
2168	tasklist.exe
2208	tasklist.exe
2552	tasklist.exe
1712	tasklist.exe
3484	tasklist.exe
484	tasklist.exe
1224	tasklist.exe
1504	tasklist.exe
2712	tasklist.exe
2984	tasklist.exe
2152	tasklist.exe
1612	tasklist.exe
880	tasklist.exe
2480	tasklist.exe
3936	tasklist.exe
880	tasklist.exe
1828	tasklist.exe
1504	tasklist.exe
3812	tasklist.exe
2620	tasklist.exe
2696	tasklist.exe
2128	tasklist.exe
1544	tasklist.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	584	tasklist.exe
Token: SeDebugPrivilege	1944	tasklist.exe
Token: SeDebugPrivilege	1612	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	1812	tasklist.exe
Token: SeDebugPrivilege	668	tasklist.exe
Token: SeDebugPrivilege	1412	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	536	tasklist.exe
Token: SeDebugPrivilege	880	tasklist.exe
Token: SeDebugPrivilege	824	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	484	tasklist.exe
Token: SeDebugPrivilege	1620	tasklist.exe
Token: SeDebugPrivilege	1604	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	628	tasklist.exe
Token: SeDebugPrivilege	780	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	2924	tasklist.exe
Token: SeDebugPrivilege	1028	tasklist.exe
Token: SeDebugPrivilege	1160	tasklist.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	2552	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	868	tasklist.exe
Token: SeDebugPrivilege	648	tasklist.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeDebugPrivilege	2104	tasklist.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	1404	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	1712	tasklist.exe
Token: SeDebugPrivilege	2916	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	880	tasklist.exe
Token: SeDebugPrivilege	1704	tasklist.exe
Token: SeDebugPrivilege	2864	tasklist.exe
Token: SeDebugPrivilege	2668	tasklist.exe
Token: SeDebugPrivilege	1796	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	1828	tasklist.exe
Token: SeDebugPrivilege	928	tasklist.exe
Token: SeDebugPrivilege	2696	tasklist.exe
Token: SeDebugPrivilege	1404	tasklist.exe
Token: SeDebugPrivilege	1360	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	484	tasklist.exe
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	2564	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	1968	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1704	836	cmd.exe	29
PID 836 wrote to memory of 1704	836	cmd.exe	29
PID 836 wrote to memory of 1704	836	cmd.exe	29
PID 836 wrote to memory of 2208	836	cmd.exe	31
PID 836 wrote to memory of 2208	836	cmd.exe	31
PID 836 wrote to memory of 2208	836	cmd.exe	31
PID 836 wrote to memory of 1640	836	cmd.exe	32
PID 836 wrote to memory of 1640	836	cmd.exe	32
PID 836 wrote to memory of 1640	836	cmd.exe	32
PID 836 wrote to memory of 2044	836	cmd.exe	33
PID 836 wrote to memory of 2044	836	cmd.exe	33
PID 836 wrote to memory of 2044	836	cmd.exe	33
PID 836 wrote to memory of 1968	836	cmd.exe	35
PID 836 wrote to memory of 1968	836	cmd.exe	35
PID 836 wrote to memory of 1968	836	cmd.exe	35
PID 836 wrote to memory of 904	836	cmd.exe	36
PID 836 wrote to memory of 904	836	cmd.exe	36
PID 836 wrote to memory of 904	836	cmd.exe	36
PID 836 wrote to memory of 1756	836	cmd.exe	37
PID 836 wrote to memory of 1756	836	cmd.exe	37
PID 836 wrote to memory of 1756	836	cmd.exe	37
PID 836 wrote to memory of 600	836	cmd.exe	38
PID 836 wrote to memory of 600	836	cmd.exe	38
PID 836 wrote to memory of 600	836	cmd.exe	38
PID 836 wrote to memory of 584	836	cmd.exe	39
PID 836 wrote to memory of 584	836	cmd.exe	39
PID 836 wrote to memory of 584	836	cmd.exe	39
PID 836 wrote to memory of 1644	836	cmd.exe	40
PID 836 wrote to memory of 1644	836	cmd.exe	40
PID 836 wrote to memory of 1644	836	cmd.exe	40
PID 836 wrote to memory of 1620	836	cmd.exe	41
PID 836 wrote to memory of 1620	836	cmd.exe	41
PID 836 wrote to memory of 1620	836	cmd.exe	41
PID 836 wrote to memory of 1944	836	cmd.exe	42
PID 836 wrote to memory of 1944	836	cmd.exe	42
PID 836 wrote to memory of 1944	836	cmd.exe	42
PID 836 wrote to memory of 1960	836	cmd.exe	43
PID 836 wrote to memory of 1960	836	cmd.exe	43
PID 836 wrote to memory of 1960	836	cmd.exe	43
PID 836 wrote to memory of 3064	836	cmd.exe	44
PID 836 wrote to memory of 3064	836	cmd.exe	44
PID 836 wrote to memory of 3064	836	cmd.exe	44
PID 836 wrote to memory of 1612	836	cmd.exe	45
PID 836 wrote to memory of 1612	836	cmd.exe	45
PID 836 wrote to memory of 1612	836	cmd.exe	45
PID 836 wrote to memory of 1712	836	cmd.exe	46
PID 836 wrote to memory of 1712	836	cmd.exe	46
PID 836 wrote to memory of 1712	836	cmd.exe	46
PID 836 wrote to memory of 2672	836	cmd.exe	47
PID 836 wrote to memory of 2672	836	cmd.exe	47
PID 836 wrote to memory of 2672	836	cmd.exe	47
PID 836 wrote to memory of 2524	836	cmd.exe	48
PID 836 wrote to memory of 2524	836	cmd.exe	48
PID 836 wrote to memory of 2524	836	cmd.exe	48
PID 836 wrote to memory of 2552	836	cmd.exe	49
PID 836 wrote to memory of 2552	836	cmd.exe	49
PID 836 wrote to memory of 2552	836	cmd.exe	49
PID 836 wrote to memory of 1868	836	cmd.exe	50
PID 836 wrote to memory of 1868	836	cmd.exe	50
PID 836 wrote to memory of 1868	836	cmd.exe	50
PID 836 wrote to memory of 1812	836	cmd.exe	51
PID 836 wrote to memory of 1812	836	cmd.exe	51
PID 836 wrote to memory of 1812	836	cmd.exe	51
PID 836 wrote to memory of 1972	836	cmd.exe	52

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\freddurstpayload.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -window hidden -command
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2208
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:600
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1644
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1620
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1960
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3064
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:768
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1552
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1624
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2592
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2992
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2744
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:304
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:608
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1528
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1156
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1500
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2928
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2720
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2008
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:608
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1528
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:912
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1724
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2600
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:824
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:608
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:816
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2032
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1836
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2476
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2868
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1668
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1028
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2936
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2120
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2920
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1688
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2372
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1360
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2504
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2568
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1796
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1948
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2988
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3036
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3044
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2880
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:628
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1156
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1568
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2324
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2860
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1652
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2604
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2332
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2560
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:904
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1364
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1360
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1828
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3032
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2292
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:896
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2660
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2804
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1152
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1364
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2940
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2712
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:912
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2936
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2548
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1404
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:484
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1084
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1624
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2624
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1532
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3028
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:980
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2552
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1528
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1504
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:832
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3036
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2576
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1616
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2604
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1544
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1924
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:628
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2932
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2240
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2052
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1728
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1932
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:552
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:648
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2208
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2604
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2180
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:112
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2712
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2248
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2968
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1108
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1504
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:928
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2260
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2208
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3004
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:980
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2804
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:912
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1676
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2116
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2004
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2480
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3052
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1000
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1752
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2180
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2900
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2620
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1160
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3064
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1616
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2448
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1700
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2392
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:880
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1700
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1968
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2248
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2256
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2268
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:884
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2712
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2924
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1224
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:980
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2808
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:304
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1528
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2580
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2004
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2392
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:896
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2148
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2196
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2948
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2636
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:928
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2984
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1364
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2212
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2476
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2204
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1364
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2152
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1000
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2460
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2804
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:884
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2212
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2476
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2944
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3056
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2024
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:768
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2916
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1676
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1668
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2004
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2564
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:896
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1504
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2288
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2964
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2208
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1468
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2288
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2480
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2564
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2480
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2204
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1160
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:884
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1376
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1160
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1700
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2612
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1932
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:1364
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1676
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1468
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3056
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:692
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:2416
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2248
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1364
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1468
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3044
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:1160
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2460
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2492
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2564
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1968
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:884
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2420
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:936
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2256
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2956
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2052
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:928
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2804
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1532
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3212
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3440
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3484
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3492
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3756
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3984
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4032
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:4040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3156
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3164
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3168
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3448
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3516
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3512
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3732
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3776
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3756
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4012
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4036
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:4044
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1700
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3168
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3220
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3536
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3532
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3808
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3828
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3840
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4088
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3044
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:2196
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3168
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3320
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3328
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3636
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3640
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3892
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3936
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3944
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3140
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3148
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3412
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3488
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3508
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3756
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4080
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:928
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:908
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3300
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3332
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3192
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3584
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3680
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3692
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3940
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:3812
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:4060
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2532
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3224
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3292
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3540
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:2440
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3580
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3948
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3996
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3156
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  - Enumerates processes with tasklist
  PID:4056
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:1700
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3508
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3544
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3548
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3908
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:3936
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3752
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:3140
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq Microsoft.Photos.exe"
  2⤵
  PID:4068
- C:\Windows\system32\find.exe
  find /I "Microsoft.Photos.exe"
  2⤵
  PID:3232
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-58-0x0000000002390000-0x00000000023A0000-memory.dmp

Filesize
64KB

Download
memory/1704-4-0x000007FEF60CE000-0x000007FEF60CF000-memory.dmp

Filesize
4KB

Download
memory/1704-6-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1704-8-0x0000000002DD4000-0x0000000002DD7000-memory.dmp

Filesize
12KB

Download
memory/1704-7-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download
memory/1704-5-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1704-1028-0x000007FEF5E10000-0x000007FEF67AD000-memory.dmp

Filesize
9.6MB

Download