442b824903eaf15f510565fc8a0e82b3e00ff16103aecbc28588ce5313b5f3bd

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4160	bcdedit.exe
4728	bcdedit.exe
1512	bcdedit.exe
1140	bcdedit.exe
5748	bcdedit.exe
1772	bcdedit.exe
1052	bcdedit.exe
5932	bcdedit.exe
1908	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe
5524	powershell.exe
1680	powershell.exe
204	powershell.exe
1420	powershell.exe
5556	powershell.exe
3076	powershell.exe
3020	powershell.exe
4208	powershell.exe
5488	powershell.exe
2028	powershell.exe
6032	powershell.exe
5204	powershell.exe
1036	powershell.exe
3332	powershell.exe
5364	powershell.exe
4652	powershell.exe
1052	powershell.exe
4624	powershell.exe
5548	powershell.exe
1420	powershell.exe
4780	powershell.exe
2364	powershell.exe
4980	powershell.exe
5676	powershell.exe
904	powershell.exe
2632	powershell.exe
3704	powershell.exe
5656	powershell.exe
3964	powershell.exe
5724	powershell.exe
4144	powershell.exe
5176	powershell.exe
4780	powershell.exe
440	powershell.exe
2376	powershell.exe
5972	powershell.exe
4100	powershell.exe
3796	powershell.exe
5828	powershell.exe
2756	powershell.exe
4472	powershell.exe
3892	powershell.exe
3824	powershell.exe
1224	powershell.exe
1972	powershell.exe
2836	powershell.exe
4184	powershell.exe
1972	powershell.exe
4272	powershell.exe
5968	powershell.exe
2772	powershell.exe
5556	powershell.exe
4120	powershell.exe
2364	powershell.exe
1960	powershell.exe
3556	powershell.exe
5244	powershell.exe
2772	powershell.exe
5512	powershell.exe
4112	powershell.exe
5676	powershell.exe
3136	powershell.exe
1584	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	c.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cardgenfix.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	c.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe

Executes dropped EXE 8 IoCs

pid	Process
2672	c.exe
3952	e.exe
2980	e.exe
6008	c.exe
1976	SecurityHealthService.exe
2388	SecurityHealthService.exe
5072	SecurityHealthService.exe
3568	SecurityHealthService.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	e.exe
2980	e.exe
2980	e.exe
2980	e.exe
2980	e.exe
2980	e.exe
2980	e.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe
6008	c.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	discord.com
42	discord.com
44	discord.com
45	discord.com
16	discord.com
19	discord.com
20	discord.com
41	discord.com
65	discord.com

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	api.ipify.org
62	ip-api.com
26	api.ipify.org
34	ipapi.co
57	ip-api.com
63	ipapi.co
28	api.ipify.org
30	ip-api.com
32	ip-api.com
35	ipapi.co
56	api.ipify.org
59	ipapi.co

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
2204	tasklist.exe
6092	tasklist.exe
4152	tasklist.exe
5364	tasklist.exe
5332	tasklist.exe
5388	tasklist.exe
5192	tasklist.exe
5280	tasklist.exe
5188	tasklist.exe
5848	tasklist.exe
5648	tasklist.exe
5228	tasklist.exe
1800	tasklist.exe
744	tasklist.exe
2324	tasklist.exe
3924	tasklist.exe
5124	tasklist.exe
1772	tasklist.exe
744	tasklist.exe
5756	tasklist.exe
3888	tasklist.exe
5296	tasklist.exe
3024	tasklist.exe
1856	tasklist.exe
5800	tasklist.exe
5600	tasklist.exe
5904	tasklist.exe
5300	tasklist.exe
4144	tasklist.exe
3592	tasklist.exe
5544	tasklist.exe
1596	tasklist.exe
216	tasklist.exe
6040	tasklist.exe
5824	tasklist.exe
3760	tasklist.exe
464	tasklist.exe
5400	tasklist.exe
3292	tasklist.exe
5364	tasklist.exe
4008	tasklist.exe
2904	tasklist.exe
1748	tasklist.exe
4644	tasklist.exe
3616	tasklist.exe
5036	tasklist.exe
2648	tasklist.exe
5884	tasklist.exe
4532	tasklist.exe
1140	tasklist.exe
5656	tasklist.exe
1648	tasklist.exe
4308	tasklist.exe
4324	tasklist.exe
3256	tasklist.exe
3296	tasklist.exe
3868	tasklist.exe
4284	tasklist.exe
5052	tasklist.exe
2676	tasklist.exe
5064	tasklist.exe
1504	tasklist.exe
3928	tasklist.exe
4636	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
6008	c.exe
3568	SecurityHealthService.exe
5072	SecurityHealthService.exe
6008	c.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000242cf-215.dat	upx
behavioral1/memory/2980-290-0x00007FFDA9630000-0x00007FFDA9C22000-memory.dmp	upx
behavioral1/files/0x000700000002426a-726.dat	upx
behavioral1/memory/2980-772-0x00007FFDBCA20000-0x00007FFDBCA4D000-memory.dmp	upx
behavioral1/memory/2980-771-0x00007FFDBCA50000-0x00007FFDBCA69000-memory.dmp	upx
behavioral1/files/0x0007000000024264-745.dat	upx
behavioral1/memory/2980-735-0x00007FFDBD550000-0x00007FFDBD55F000-memory.dmp	upx
behavioral1/memory/2980-734-0x00007FFDBCF70000-0x00007FFDBCF94000-memory.dmp	upx
behavioral1/files/0x0007000000024269-725.dat	upx
behavioral1/files/0x0008000000024267-724.dat	upx
behavioral1/files/0x0007000000024266-723.dat	upx
behavioral1/files/0x00070000000242ee-721.dat	upx
behavioral1/files/0x00070000000242e1-720.dat	upx
behavioral1/files/0x00070000000242cc-719.dat	upx
behavioral1/files/0x00070000000242ce-679.dat	upx
behavioral1/files/0x0007000000024265-669.dat	upx
behavioral1/memory/2980-1316-0x00007FFDA9630000-0x00007FFDA9C22000-memory.dmp	upx
behavioral1/memory/2980-1326-0x00007FFDBCF70000-0x00007FFDBCF94000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	c.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0008000000024221-11.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe

Kills process with taskkill 3 IoCs

pid	Process
1488	taskkill.exe
3592	taskkill.exe
464	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5864	schtasks.exe
3584	schtasks.exe
1132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6008	c.exe
6008	c.exe
2028	powershell.exe
2028	powershell.exe
1972	powershell.exe
1972	powershell.exe
3136	powershell.exe
3136	powershell.exe
2836	powershell.exe
2836	powershell.exe
4780	powershell.exe
4780	powershell.exe
3332	powershell.exe
3332	powershell.exe
5556	powershell.exe
5556	powershell.exe
5244	powershell.exe
5244	powershell.exe
440	powershell.exe
440	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
4184	powershell.exe
4184	powershell.exe
4772	powershell.exe
4772	powershell.exe
4184	powershell.exe
4772	powershell.exe
5860	powershell.exe
5860	powershell.exe
5860	powershell.exe
904	powershell.exe
904	powershell.exe
904	powershell.exe
5072	SecurityHealthService.exe
5072	SecurityHealthService.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
3568	SecurityHealthService.exe
3568	SecurityHealthService.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
6032	powershell.exe
6032	powershell.exe
6032	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
5876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6008	c.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeIncreaseQuotaPrivilege	2028	powershell.exe
Token: SeSecurityPrivilege	2028	powershell.exe
Token: SeTakeOwnershipPrivilege	2028	powershell.exe
Token: SeLoadDriverPrivilege	2028	powershell.exe
Token: SeSystemProfilePrivilege	2028	powershell.exe
Token: SeSystemtimePrivilege	2028	powershell.exe
Token: SeProfSingleProcessPrivilege	2028	powershell.exe
Token: SeIncBasePriorityPrivilege	2028	powershell.exe
Token: SeCreatePagefilePrivilege	2028	powershell.exe
Token: SeBackupPrivilege	2028	powershell.exe
Token: SeRestorePrivilege	2028	powershell.exe
Token: SeShutdownPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeSystemEnvironmentPrivilege	2028	powershell.exe
Token: SeRemoteShutdownPrivilege	2028	powershell.exe
Token: SeUndockPrivilege	2028	powershell.exe
Token: SeManageVolumePrivilege	2028	powershell.exe
Token: 33	2028	powershell.exe
Token: 34	2028	powershell.exe
Token: 35	2028	powershell.exe
Token: 36	2028	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeIncreaseQuotaPrivilege	1972	powershell.exe
Token: SeSecurityPrivilege	1972	powershell.exe
Token: SeTakeOwnershipPrivilege	1972	powershell.exe
Token: SeLoadDriverPrivilege	1972	powershell.exe
Token: SeSystemProfilePrivilege	1972	powershell.exe
Token: SeSystemtimePrivilege	1972	powershell.exe
Token: SeProfSingleProcessPrivilege	1972	powershell.exe
Token: SeIncBasePriorityPrivilege	1972	powershell.exe
Token: SeCreatePagefilePrivilege	1972	powershell.exe
Token: SeBackupPrivilege	1972	powershell.exe
Token: SeRestorePrivilege	1972	powershell.exe
Token: SeShutdownPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeSystemEnvironmentPrivilege	1972	powershell.exe
Token: SeRemoteShutdownPrivilege	1972	powershell.exe
Token: SeUndockPrivilege	1972	powershell.exe
Token: SeManageVolumePrivilege	1972	powershell.exe
Token: 33	1972	powershell.exe
Token: 34	1972	powershell.exe
Token: 35	1972	powershell.exe
Token: 36	1972	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeIncreaseQuotaPrivilege	3136	powershell.exe
Token: SeSecurityPrivilege	3136	powershell.exe
Token: SeTakeOwnershipPrivilege	3136	powershell.exe
Token: SeLoadDriverPrivilege	3136	powershell.exe
Token: SeSystemProfilePrivilege	3136	powershell.exe
Token: SeSystemtimePrivilege	3136	powershell.exe
Token: SeProfSingleProcessPrivilege	3136	powershell.exe
Token: SeIncBasePriorityPrivilege	3136	powershell.exe
Token: SeCreatePagefilePrivilege	3136	powershell.exe
Token: SeBackupPrivilege	3136	powershell.exe
Token: SeRestorePrivilege	3136	powershell.exe
Token: SeShutdownPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeSystemEnvironmentPrivilege	3136	powershell.exe
Token: SeRemoteShutdownPrivilege	3136	powershell.exe
Token: SeUndockPrivilege	3136	powershell.exe
Token: SeManageVolumePrivilege	3136	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	c.exe
6008	c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2672	2748	cardgenfix.exe	88
PID 2748 wrote to memory of 3952	2748	cardgenfix.exe	90
PID 3952 wrote to memory of 2980	3952	e.exe	92
PID 2980 wrote to memory of 5056	2980	e.exe	93
PID 2980 wrote to memory of 5312	2980	e.exe	94
PID 2980 wrote to memory of 5592	2980	e.exe	95
PID 2672 wrote to memory of 6008	2672	c.exe	96
PID 6008 wrote to memory of 6024	6008	c.exe	97
PID 6008 wrote to memory of 4216	6008	c.exe	99
PID 6008 wrote to memory of 2028	6008	c.exe	102
PID 6008 wrote to memory of 1972	6008	c.exe	104
PID 6008 wrote to memory of 3136	6008	c.exe	106
PID 6008 wrote to memory of 4768	6008	c.exe	108
PID 6008 wrote to memory of 2836	6008	c.exe	110
PID 6008 wrote to memory of 1064	6008	c.exe	112
PID 6008 wrote to memory of 4780	6008	c.exe	114
PID 6008 wrote to memory of 3332	6008	c.exe	116
PID 6008 wrote to memory of 4928	6008	c.exe	118
PID 6008 wrote to memory of 5556	6008	c.exe	120
PID 6008 wrote to memory of 5244	6008	c.exe	122
PID 6008 wrote to memory of 5524	6008	c.exe	124
PID 6008 wrote to memory of 440	6008	c.exe	126
PID 6008 wrote to memory of 5700	6008	c.exe	128
PID 5700 wrote to memory of 5748	5700	cmd.exe	130
PID 6008 wrote to memory of 5864	6008	c.exe	132
PID 6008 wrote to memory of 5996	6008	c.exe	134
PID 5996 wrote to memory of 6024	5996	cmd.exe	136
PID 6008 wrote to memory of 4160	6008	c.exe	137
PID 6008 wrote to memory of 4728	6008	c.exe	139
PID 6008 wrote to memory of 1512	6008	c.exe	141
PID 6008 wrote to memory of 5516	6008	c.exe	148
PID 6008 wrote to memory of 4336	6008	c.exe	150
PID 6008 wrote to memory of 5296	6008	c.exe	153
PID 6008 wrote to memory of 1864	6008	c.exe	155
PID 2388 wrote to memory of 5072	2388	SecurityHealthService.exe	157
PID 1976 wrote to memory of 3568	1976	SecurityHealthService.exe	158
PID 6008 wrote to memory of 2772	6008	c.exe	205
PID 5072 wrote to memory of 3868	5072	SecurityHealthService.exe	161
PID 3568 wrote to memory of 2744	3568	SecurityHealthService.exe	163
PID 6008 wrote to memory of 4184	6008	c.exe	165
PID 6008 wrote to memory of 4772	6008	c.exe	241
PID 5072 wrote to memory of 2204	5072	SecurityHealthService.exe	169
PID 3568 wrote to memory of 5632	3568	SecurityHealthService.exe	171
PID 6008 wrote to memory of 5740	6008	c.exe	173
PID 5740 wrote to memory of 5968	5740	cmd.exe	174
PID 6008 wrote to memory of 5860	6008	c.exe	175
PID 6008 wrote to memory of 3968	6008	c.exe	177
PID 6008 wrote to memory of 1488	6008	c.exe	179
PID 6008 wrote to memory of 464	6008	c.exe	474
PID 6008 wrote to memory of 5416	6008	c.exe	183
PID 6008 wrote to memory of 904	6008	c.exe	185
PID 5072 wrote to memory of 5548	5072	SecurityHealthService.exe	225
PID 6008 wrote to memory of 6004	6008	c.exe	189
PID 6004 wrote to memory of 536	6004	cmd.exe	190
PID 5072 wrote to memory of 1420	5072	SecurityHealthService.exe	191
PID 3568 wrote to memory of 6032	3568	SecurityHealthService.exe	368
PID 6008 wrote to memory of 216	6008	c.exe	232
PID 6008 wrote to memory of 1988	6008	c.exe	197
PID 5072 wrote to memory of 5828	5072	SecurityHealthService.exe	444
PID 3568 wrote to memory of 4120	3568	SecurityHealthService.exe	460
PID 5072 wrote to memory of 1860	5072	SecurityHealthService.exe	601
PID 3568 wrote to memory of 2772	3568	SecurityHealthService.exe	612
PID 5072 wrote to memory of 1584	5072	SecurityHealthService.exe	207
PID 3568 wrote to memory of 2208	3568	SecurityHealthService.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cardgenfix.exe
"C:\Users\Admin\AppData\Local\Temp\cardgenfix.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\c.exe
  "C:\Users\Admin\AppData\Local\Temp\c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\c.exe
    "C:\Users\Admin\AppData\Local\Temp\c.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Enumerates VirtualBox DLL files
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Looks for VMWare drivers on disk
    - Looks for VMWare services registry key.
    - Drops startup file
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6024
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3136
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
      4⤵
      PID:4768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2836
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:1064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3332
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_PnPEntity get Name,DeviceID /format:csv
      4⤵
      PID:4928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5244
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:5524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:440
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5700
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        
        PID:5748
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        
        PID:6024
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4160
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4728
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1512
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5516
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4336
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5296
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4772
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5740
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:5968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5860
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3968
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /pid 5968
      4⤵
      Kills process with taskkill
      PID:1488
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:464
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:904
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:536
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:216
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1988
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4756
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe"
      4⤵
      PID:5548
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5060
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4772
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1268
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5492
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2040
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5696
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5412
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3920
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5992
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3336
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1748
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:696
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5576
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2376
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5756
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5324
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3116
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3004
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:744
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3668
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:5724
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3048
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2320
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5696
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5064
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5412
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4504
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5484
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5684
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5600
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4256
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4172
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3912
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5764
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1684
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5892
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1000
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6036
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5956
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:4764
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3016
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2632
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5592
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5228
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3352
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5568
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      PID:2012
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3340
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5204
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5328
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1608
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5584
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3584
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:960
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:6056
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3252
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5932
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6044
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3984
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5592
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1648
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1204
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4268
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5972
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3892
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5728
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5764
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3964
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3312
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4040
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:4220
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:5872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:5684
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5300
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1048
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1972
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2992
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4260
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5612
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3704
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3080
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1860
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5320
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5240
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5756
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2324
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5400
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4240
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1348
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6088
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5280
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3592
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2376
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4612
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4404
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5628
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:2136
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5180
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3000
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4548
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5528
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5840
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3252
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5388
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3968
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2200
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4228
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:816
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3944
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5296
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5300
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5364
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3300
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2324
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1460
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3264
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4184
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2136
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3940
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1564
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:4324
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5312
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4504
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1488
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      PID:1532
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1680
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5512
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5968
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5744
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6096
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5724
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2564
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5696
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1060
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4256
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:6048
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5476
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3244
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:960
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5296
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5324
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3484
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4996
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3932
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5720
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1456
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5356
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4432
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:816
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1080
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3352
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2348
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:8
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1144
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:316
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4212
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3796
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5708
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5868
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2780
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5884
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2184
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5204
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5244
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4428
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3944
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3340
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1052
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5796
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2020
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1988
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5360
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5324
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5256
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5544
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5672
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5848
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5812
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1564
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3352
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1772
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5992
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1988
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5080
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3672
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5696
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1504
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3824
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5964
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3340
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4720
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:8
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4284
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:712
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4172
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4180
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3940
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1268
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4268
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1596
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1948
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5272
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4120
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5720
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4256
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:988
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5492
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5180
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5728
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5408
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:1992
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1420
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4308
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:316
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5856
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4836
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5812
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1052
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1040
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1908
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5940
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5840
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5572
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2324
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5268
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3352
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3044
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3928
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4264
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2560
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:540
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4020
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3088
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2648
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5720
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5276
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3944
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3468
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1128
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5780
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:752
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6028
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5388
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3344
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3996
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:2812
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5660
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1540
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2012
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3088
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2564
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:6092
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2324
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5156
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4392
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4828
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4248
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2208
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1092
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:6020
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3984
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4060
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5388
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1460
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4256
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5448
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5272
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:5656
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5196
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:5252
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:720
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5728
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:220
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:5360
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4472
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4632
- C:\Users\Admin\AppData\Local\Temp\e.exe
  "C:\Users\Admin\AppData\Local\Temp\e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Users\Admin\AppData\Local\Temp\e.exe
    "C:\Users\Admin\AppData\Local\Temp\e.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title CARD GEN
      4⤵
      PID:5056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5592

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Drops startup file
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2744
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:5632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:2208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2632
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_PnPEntity get Name,DeviceID /format:csv
    3⤵
    PID:5812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    PID:5912
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:5376
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:3888
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:1032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:4996
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2552
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5932
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1908
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1060
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3000
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5904
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5812
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5356
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1972
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4120
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
    3⤵
    PID:3888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 536
    3⤵
    - Kills process with taskkill
    PID:464
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4652
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6016
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:1152
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5144
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3020
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3204
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:1020
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:1568
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4892
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5660
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    PID:408
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2564
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3968
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5980
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4228
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3924
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4860
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2020
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3556
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4612
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:828
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4152
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3344
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2016
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1128
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4208
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5780
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5220
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5064
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6080
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5272
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4344
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3620
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3888
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4996
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2728
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3356
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5952
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:204
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4992
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5504
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5388
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2648
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5252
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5304
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5680
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4996
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5672
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3476
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4828
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:8
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4720
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2836
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5012
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2716
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5760
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2976
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5828
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5124
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1116
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5276
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2320
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3584
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5424
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:624
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5704
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1000
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3824
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5364
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4112
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5488
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2848
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:828
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4272
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:6040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5232
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1596
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4256
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5188
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5732
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1128
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1048
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1716
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2648
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4984
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6044
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2476
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3344
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3944
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5364
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:540
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5100
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5232
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5764
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5724
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3436
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3296
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5372
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5196
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3128
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4744
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5796
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5728
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4264
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2660
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3268
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:5892
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3880
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4636
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6084
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5848
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2208
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5984
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4732
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5980
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3556
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:824
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:720
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2412
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1280
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:744
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2740
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1864
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2660
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1060
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5096
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2120
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5544
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5840
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:744
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1852
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4392
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5472
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3280
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5608
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4344
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3128
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4636
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4860
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2772
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1772
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4284
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4260
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5152
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5332
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4872
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4776
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2996
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5484
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5508
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1180
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5520
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3820
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6028
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1420
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3432
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1028
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5136
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4076
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5240
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5176
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1280
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5524
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5760
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3760
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3476
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6088
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1540

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Drops startup file
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3868
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:6092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5364
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_PnPEntity get Name,DeviceID /format:csv
    3⤵
    PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4472
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:204
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:2552
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:376
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:5600
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:6032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:5764
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1140
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1772
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5392
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3076
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4768
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1748
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5556
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5576
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1668
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2848
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4780
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4208
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 536
    3⤵
    - Kills process with taskkill
    PID:3592
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:204
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:4656
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5724
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4272
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:3704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5512
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4100
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:5880
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:5164
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4336
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5364
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:2324
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1680
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
    3⤵
    PID:4472
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4128
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2136
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5168
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2772
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5904
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5312
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5876
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2904
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2260
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5364
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4308
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3296
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5676
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3616
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3448
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6088
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4576
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1420
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1864
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2480
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3292
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3340
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5348
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5408
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4452
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2992
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3932
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3616
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5200
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5968
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5344
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3000
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4520
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1040
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3336
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1820
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4980
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1204
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2848
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5300
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5380
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3296
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3788
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5864
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2796
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4760
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5192
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2988
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5512
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5656
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5220
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4636
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3924
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5280
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1048
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:668
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4392
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:1456
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4636
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1000
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6068
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2976
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2648
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4744
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4440
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2024
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5280
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4516
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1412
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4832
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1680
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3644
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3044
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4248
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1504
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5280
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1420
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1800
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2428
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2040
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5148
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2200
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5204
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:5956
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4828
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4776
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1080
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:944
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6140
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5956
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:220
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4372
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3916
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5824
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5080
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1960
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5396
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4184
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5508
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6088
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4828
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2368
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5868
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4452
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4804
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5716
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1856
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3592
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2376
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2564
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5720
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3704
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5696
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4828
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5828
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4644
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4344
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1988
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1348
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4172
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2764
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5800
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3264
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5992
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4260
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5624
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4008
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3964
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5084
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3708
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1456
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:6028
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2872
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5796
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5984
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3924
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1140
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1488
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4144
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5196
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4892
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:176
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1272
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4112
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5484
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4980
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5364
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1148
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1224
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:6084
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5144
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5452
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5648
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4752
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5448
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5512
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2208
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion