6e18f850d03ad79347d961f4a54ac5592666e32ec4f6d4c0ed37b4b229e609de

Analysis

user interaction
yes
max time kernel
183s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoonaWare.exe
Size 35.2MB
Sample260511-mthf8aaz6m
SHA256 6e18f850d03ad79347d961f4a54ac5592666e32ec4f6d4c0ed37b4b229e609de
MD5 33190c43241a86922badd7d2953df9ea
SHA1 5ae9f76bdfb562c69aecd8e966fb403d6bcf5af2
SHA512 20a36da9e73cd348adc64357822df7023713119c8f51e31a62a59447f23057630358545abf97bec00d3caec6d49470b9c2d80cf7cf01fa62f816b32a3e8f5a23
SSDEEP 786432:hXuKzAW8CyVmdGLLsKMMo5ovsVuRp8hNffIR4gRcqcF13usOd9GsjNu0:h7zAWvyVQpoeOyYc3u5T
TLSH
T1A787338076D90499F14A4335E4E3EB528AC7B022473BD4CB1BF8A6861E736E5FD75B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Loads dropped DLL 23 IoCs

pid	Process
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe
2696	LoonaWare.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	api.ipify.org
34	ip-api.com
32	api.ipify.org

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1084	tasklist.exe
4244	tasklist.exe
8	tasklist.exe
3660	tasklist.exe
4056	tasklist.exe
1264	tasklist.exe
1708	tasklist.exe
956	tasklist.exe
4984	tasklist.exe
764	tasklist.exe
5060	tasklist.exe
2548	tasklist.exe
1968	tasklist.exe
3948	tasklist.exe
4572	tasklist.exe
2016	tasklist.exe
2956	tasklist.exe
3948	tasklist.exe
3504	tasklist.exe
4788	tasklist.exe
2280	tasklist.exe
4256	tasklist.exe
3624	tasklist.exe
4336	tasklist.exe
1972	tasklist.exe
4212	tasklist.exe
4188	tasklist.exe
2232	tasklist.exe
4092	tasklist.exe
3268	tasklist.exe
4656	tasklist.exe
4492	tasklist.exe
4060	tasklist.exe
3968	tasklist.exe
4616	tasklist.exe
4536	tasklist.exe
2584	tasklist.exe
4356	tasklist.exe
3280	tasklist.exe
2052	tasklist.exe
2268	tasklist.exe
4224	tasklist.exe
3048	tasklist.exe
5088	tasklist.exe
2572	tasklist.exe
2744	tasklist.exe
432	tasklist.exe
2332	tasklist.exe
1420	tasklist.exe
5056	tasklist.exe
3012	tasklist.exe
4492	tasklist.exe
4244	tasklist.exe
4136	tasklist.exe
4800	tasklist.exe
1772	tasklist.exe
2496	tasklist.exe
2784	tasklist.exe
4224	tasklist.exe
3960	tasklist.exe
404	tasklist.exe
4060	tasklist.exe
1040	tasklist.exe
3964	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\loona_wallpaper.bmp"	LoonaWare.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
3748	powershell.exe
2380	powershell.exe
4964	powershell.exe
536	powershell.exe
924	powershell.exe
4272	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 5 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2556	netsh.exe
4316	cmd.exe
4272	powershell.exe
4448	netsh.exe
4368	cmd.exe

System Owner/User Discovery 1 TTPs 2 IoCs

Attempt to identify the primary or current user.

discovery

System Owner/User Discovery

T1033

pid	Process
2212	cmd.exe
3748	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4580	WMIC.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2484	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1700	systeminfo.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\WallpaperStyle = "10"	LoonaWare.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\Desktop\TileWallpaper = "0"	LoonaWare.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
536	powershell.exe
536	powershell.exe
924	powershell.exe
924	powershell.exe
4272	powershell.exe
4272	powershell.exe
4272	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
3748	powershell.exe
3748	powershell.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
4304	tasklist.exe
4304	tasklist.exe
3748	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeIncreaseQuotaPrivilege	2428	WMIC.exe
Token: SeSecurityPrivilege	2428	WMIC.exe
Token: SeTakeOwnershipPrivilege	2428	WMIC.exe
Token: SeLoadDriverPrivilege	2428	WMIC.exe
Token: SeSystemProfilePrivilege	2428	WMIC.exe
Token: SeSystemtimePrivilege	2428	WMIC.exe
Token: SeProfSingleProcessPrivilege	2428	WMIC.exe
Token: SeIncBasePriorityPrivilege	2428	WMIC.exe
Token: SeCreatePagefilePrivilege	2428	WMIC.exe
Token: SeBackupPrivilege	2428	WMIC.exe
Token: SeRestorePrivilege	2428	WMIC.exe
Token: SeShutdownPrivilege	2428	WMIC.exe
Token: SeDebugPrivilege	2428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2428	WMIC.exe
Token: SeRemoteShutdownPrivilege	2428	WMIC.exe
Token: SeUndockPrivilege	2428	WMIC.exe
Token: SeManageVolumePrivilege	2428	WMIC.exe
Token: 33	2428	WMIC.exe
Token: 34	2428	WMIC.exe
Token: 35	2428	WMIC.exe
Token: 36	2428	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2428	WMIC.exe
Token: SeSecurityPrivilege	2428	WMIC.exe
Token: SeTakeOwnershipPrivilege	2428	WMIC.exe
Token: SeLoadDriverPrivilege	2428	WMIC.exe
Token: SeSystemProfilePrivilege	2428	WMIC.exe
Token: SeSystemtimePrivilege	2428	WMIC.exe
Token: SeProfSingleProcessPrivilege	2428	WMIC.exe
Token: SeIncBasePriorityPrivilege	2428	WMIC.exe
Token: SeCreatePagefilePrivilege	2428	WMIC.exe
Token: SeBackupPrivilege	2428	WMIC.exe
Token: SeRestorePrivilege	2428	WMIC.exe
Token: SeShutdownPrivilege	2428	WMIC.exe
Token: SeDebugPrivilege	2428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2428	WMIC.exe
Token: SeRemoteShutdownPrivilege	2428	WMIC.exe
Token: SeUndockPrivilege	2428	WMIC.exe
Token: SeManageVolumePrivilege	2428	WMIC.exe
Token: 33	2428	WMIC.exe
Token: 34	2428	WMIC.exe
Token: 35	2428	WMIC.exe
Token: 36	2428	WMIC.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe
Token: SeDebugPrivilege	3976	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2696	4592	LoonaWare.exe	85
PID 2696 wrote to memory of 4368	2696	LoonaWare.exe	86
PID 4368 wrote to memory of 2556	4368	cmd.exe	88
PID 2696 wrote to memory of 3492	2696	LoonaWare.exe	92
PID 3492 wrote to memory of 536	3492	cmd.exe	94
PID 2696 wrote to memory of 3244	2696	LoonaWare.exe	95
PID 3244 wrote to memory of 924	3244	cmd.exe	97
PID 2696 wrote to memory of 4316	2696	LoonaWare.exe	98
PID 536 wrote to memory of 1700	536	powershell.exe	100
PID 4316 wrote to memory of 4272	4316	cmd.exe	101
PID 924 wrote to memory of 2484	924	powershell.exe	103
PID 2696 wrote to memory of 4588	2696	LoonaWare.exe	104
PID 4588 wrote to memory of 3200	4588	cmd.exe	106
PID 4272 wrote to memory of 4448	4272	powershell.exe	107
PID 2696 wrote to memory of 2212	2696	LoonaWare.exe	108
PID 2212 wrote to memory of 3748	2212	cmd.exe	110
PID 2696 wrote to memory of 1696	2696	LoonaWare.exe	111
PID 3200 wrote to memory of 4304	3200	powershell.exe	113
PID 1696 wrote to memory of 2380	1696	cmd.exe	114
PID 2696 wrote to memory of 1492	2696	LoonaWare.exe	115
PID 1492 wrote to memory of 4964	1492	cmd.exe	117
PID 3748 wrote to memory of 3976	3748	powershell.exe	118
PID 2380 wrote to memory of 2428	2380	powershell.exe	119
PID 4964 wrote to memory of 2824	4964	powershell.exe	120
PID 2696 wrote to memory of 3740	2696	LoonaWare.exe	124
PID 3740 wrote to memory of 764	3740	cmd.exe	126
PID 2696 wrote to memory of 1596	2696	LoonaWare.exe	128
PID 1596 wrote to memory of 2572	1596	cmd.exe	131
PID 2696 wrote to memory of 396	2696	LoonaWare.exe	132
PID 396 wrote to memory of 1420	396	cmd.exe	134
PID 2696 wrote to memory of 444	2696	LoonaWare.exe	135
PID 444 wrote to memory of 3280	444	cmd.exe	137
PID 2696 wrote to memory of 2812	2696	LoonaWare.exe	138
PID 2812 wrote to memory of 3968	2812	cmd.exe	140
PID 2696 wrote to memory of 4796	2696	LoonaWare.exe	141
PID 4796 wrote to memory of 2052	4796	cmd.exe	143
PID 2696 wrote to memory of 624	2696	LoonaWare.exe	144
PID 624 wrote to memory of 2924	624	cmd.exe	146
PID 2696 wrote to memory of 4756	2696	LoonaWare.exe	147
PID 4756 wrote to memory of 3112	4756	cmd.exe	149
PID 2696 wrote to memory of 1444	2696	LoonaWare.exe	150
PID 1444 wrote to memory of 1704	1444	cmd.exe	152
PID 2696 wrote to memory of 2772	2696	LoonaWare.exe	153
PID 2772 wrote to memory of 3268	2772	cmd.exe	155
PID 2696 wrote to memory of 2168	2696	LoonaWare.exe	156
PID 2168 wrote to memory of 4984	2168	cmd.exe	158
PID 2696 wrote to memory of 1896	2696	LoonaWare.exe	159
PID 1896 wrote to memory of 5080	1896	cmd.exe	161
PID 2696 wrote to memory of 4684	2696	LoonaWare.exe	162
PID 4684 wrote to memory of 5056	4684	cmd.exe	164
PID 2696 wrote to memory of 4084	2696	LoonaWare.exe	165
PID 4084 wrote to memory of 4572	4084	cmd.exe	167
PID 2696 wrote to memory of 2064	2696	LoonaWare.exe	169
PID 2064 wrote to memory of 3788	2064	cmd.exe	171
PID 2696 wrote to memory of 1788	2696	LoonaWare.exe	172
PID 1788 wrote to memory of 3012	1788	cmd.exe	174
PID 2696 wrote to memory of 228	2696	LoonaWare.exe	175
PID 228 wrote to memory of 1108	228	cmd.exe	177
PID 2696 wrote to memory of 4860	2696	LoonaWare.exe	179
PID 4860 wrote to memory of 3744	4860	cmd.exe	181
PID 2696 wrote to memory of 2032	2696	LoonaWare.exe	182
PID 2032 wrote to memory of 1840	2032	cmd.exe	184
PID 2696 wrote to memory of 4320	2696	LoonaWare.exe	185
PID 4320 wrote to memory of 4656	4320	cmd.exe	187

C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe
"C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe
  "C:\Users\Admin\AppData\Local\Temp\LoonaWare.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "systeminfo > "C:\Users\Admin\AppData\Local\Temp\lw_sysinfo.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "systeminfo > "C:\Users\Admin\AppData\Local\Temp\lw_sysinfo.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:536
    - - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        5⤵
        Gathers system information
        
        PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\lw_ipconfig.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\lw_ipconfig.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /all
        5⤵
        Gathers network information
        
        PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\lw_wifi_profiles.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "netsh wlan show profiles > "C:\Users\Admin\AppData\Local\Temp\lw_wifi_profiles.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "tasklist /V > "C:\Users\Admin\AppData\Local\Temp\lw_tasks.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "tasklist /V > "C:\Users\Admin\AppData\Local\Temp\lw_tasks.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Windows\system32\tasklist.exe
        
        "C:\Windows\system32\tasklist.exe" /V
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "whoami /all > "C:\Users\Admin\AppData\Local\Temp\lw_whoami.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - System Owner/User Discovery
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "whoami /all > "C:\Users\Admin\AppData\Local\Temp\lw_whoami.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Owner/User Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\lw_cpu.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\lw_cpu.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" cpu get name /value
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -WindowStyle Normal -Command "wmic memorychip get capacity /value > "C:\Users\Admin\AppData\Local\Temp\lw_ram.txt" 2>$null; Start-Sleep -Milliseconds 150""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Normal -Command "wmic memorychip get capacity /value > "C:\Users\Admin\AppData\Local\Temp\lw_ram.txt" 2>$null; Start-Sleep -Milliseconds 150"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" memorychip get capacity /value
        5⤵
        
        PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4752
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2188
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4628
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_videocontroller get name /value"
    3⤵
    PID:4952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name /value
      4⤵
      Detects videocard installed
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
    3⤵
    PID:2824
  - - C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1840
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5056
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3928
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3980
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3984
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3864
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2100
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1232
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:884
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3360
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2424
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:904
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4260
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1712
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1876
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:212
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1320
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2656
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3968
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3920
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3988
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4712
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:780
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4808
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4468
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3772
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3136
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1952
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1784
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2632
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4532
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4884
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:916
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3340
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2448
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3972
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1080
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4196
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4896
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1580
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3528
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2216
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3288
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3828
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4024
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3760
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1108
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4864
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4616
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2348
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3684
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:900
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:764
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2604
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1704
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3304
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2692
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:3160
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5044
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4520
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:964
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1908
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2756
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:636
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:2768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1936
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4048
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1904
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1532
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:1116
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH"
    3⤵
    PID:5068
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
      4⤵
      Enumerates processes with tasklist
      PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Owner/User Discovery

T1033

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...