442b824903eaf15f510565fc8a0e82b3e00ff16103aecbc28588ce5313b5f3bd

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\vboxhook.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	c.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxhook.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxdisp.dll	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\vboxogl.dll	SecurityHealthService.exe

Enumerates VirtualBox registry keys 2 TTPs 12 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	c.exe

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2208	bcdedit.exe
2140	bcdedit.exe
3944	bcdedit.exe
4468	bcdedit.exe
1208	bcdedit.exe
2820	bcdedit.exe
2076	bcdedit.exe
4644	bcdedit.exe
1216	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4156	powershell.exe
4704	powershell.exe
2304	powershell.exe
1952	powershell.exe
868	powershell.exe
1716	powershell.exe
2888	powershell.exe
2452	powershell.exe
1460	powershell.exe
3328	powershell.exe
1472	powershell.exe
2312	powershell.exe
792	powershell.exe
3840	powershell.exe
796	powershell.exe
4244	powershell.exe
4088	powershell.exe
4468	powershell.exe
1652	powershell.exe
3832	powershell.exe
2184	powershell.exe
4740	powershell.exe
4636	powershell.exe
3112	powershell.exe
3476	powershell.exe
408	powershell.exe
1464	powershell.exe
2904	powershell.exe
4004	powershell.exe
4404	powershell.exe
4564	powershell.exe
1652	powershell.exe
3112	powershell.exe
1704	powershell.exe
4896	powershell.exe
1520	powershell.exe
4756	powershell.exe
1040	powershell.exe
1136	powershell.exe
428	powershell.exe
3004	powershell.exe
3996	powershell.exe
1252	powershell.exe
4880	powershell.exe
2884	powershell.exe
2780	powershell.exe
1688	powershell.exe
1444	powershell.exe
3052	powershell.exe
3980	powershell.exe
4664	powershell.exe
3204	powershell.exe
3680	powershell.exe
4256	powershell.exe
2436	powershell.exe
4160	powershell.exe
1944	powershell.exe
4052	powershell.exe
4024	powershell.exe
1716	powershell.exe
1108	powershell.exe
792	powershell.exe
488	powershell.exe
2824	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare drivers on disk 2 TTPs 12 IoCs

File and Directory Discovery

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmusbmouse.sys	SecurityHealthService.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	c.exe
File opened (read-only)	C:\Windows\System32\drivers\vmci.sys	c.exe

Looks for VMWare services registry key. 1 TTPs 9 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	c.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthCheck.vbs	SecurityHealthService.exe

Executes dropped EXE 8 IoCs

pid	Process
4324	c.exe
1396	e.exe
2036	e.exe
816	c.exe
2796	SecurityHealthService.exe
1812	SecurityHealthService.exe
4612	SecurityHealthService.exe
1544	SecurityHealthService.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc	SecurityHealthService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SecurityHealthSvc\ = "Service"	SecurityHealthService.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	e.exe
2036	e.exe
2036	e.exe
2036	e.exe
2036	e.exe
2036	e.exe
2036	e.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe
816	c.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SecurityHealthUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsHealth\\SecurityHealthService.exe\""	SecurityHealthService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com
1	discord.com
2	discord.com
3	discord.com
11	discord.com
12	discord.com
18	discord.com
28	discord.com
14	discord.com

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipapi.co
23	ip-api.com
24	ipapi.co
1	api.ipify.org
6	api.ipify.org
7	ip-api.com
8	ipapi.co
15	api.ipify.org
16	ip-api.com
17	ipapi.co
22	api.ipify.org
1	ip-api.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SecurityHealthService.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1944	tasklist.exe
808	tasklist.exe
2820	tasklist.exe
3528	tasklist.exe
4212	tasklist.exe
1560	tasklist.exe
2672	tasklist.exe
4468	tasklist.exe
1648	tasklist.exe
4312	tasklist.exe
1068	tasklist.exe
1656	tasklist.exe
1860	tasklist.exe
3832	tasklist.exe
4756	tasklist.exe
2236	tasklist.exe
1716	tasklist.exe
1660	tasklist.exe
2076	tasklist.exe
4160	tasklist.exe
3192	tasklist.exe
580	tasklist.exe
3052	tasklist.exe
3728	tasklist.exe
1032	tasklist.exe
2676	tasklist.exe
1104	tasklist.exe
2032	tasklist.exe
1004	tasklist.exe
3680	tasklist.exe
920	tasklist.exe
580	tasklist.exe
3676	tasklist.exe
4056	tasklist.exe
3372	tasklist.exe
4900	tasklist.exe
4240	tasklist.exe
972	tasklist.exe
2416	tasklist.exe
5088	tasklist.exe
4296	tasklist.exe
3328	tasklist.exe
468	tasklist.exe
2032	tasklist.exe
4712	tasklist.exe
468	tasklist.exe
1036	tasklist.exe
4276	tasklist.exe
2692	tasklist.exe
3692	tasklist.exe
2996	tasklist.exe
3500	tasklist.exe
2116	tasklist.exe
4468	tasklist.exe
3540	tasklist.exe
4736	tasklist.exe
1336	tasklist.exe
2912	tasklist.exe
2184	tasklist.exe
2464	tasklist.exe
2568	tasklist.exe
4860	tasklist.exe
2604	tasklist.exe
3832	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
816	c.exe
1544	SecurityHealthService.exe
4612	SecurityHealthService.exe
816	c.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b429-128.dat	upx
behavioral2/memory/2036-289-0x00007FFD23A90000-0x00007FFD24082000-memory.dmp	upx
behavioral2/files/0x001900000002b428-1058.dat	upx
behavioral2/memory/2036-1123-0x00007FFD3A6D0000-0x00007FFD3A6DF000-memory.dmp	upx
behavioral2/files/0x001600000002b3f7-1131.dat	upx
behavioral2/memory/2036-1180-0x00007FFD39C70000-0x00007FFD39C9D000-memory.dmp	upx
behavioral2/memory/2036-1170-0x00007FFD3A6B0000-0x00007FFD3A6C9000-memory.dmp	upx
behavioral2/memory/2036-1120-0x00007FFD3A6E0000-0x00007FFD3A704000-memory.dmp	upx
behavioral2/files/0x001900000002b3fc-1106.dat	upx
behavioral2/files/0x001900000002b3fb-1105.dat	upx
behavioral2/files/0x001900000002b3fa-1104.dat	upx
behavioral2/files/0x001900000002b3f9-1103.dat	upx
behavioral2/files/0x001900000002b42c-1101.dat	upx
behavioral2/files/0x001900000002b42a-1100.dat	upx
behavioral2/files/0x001900000002b427-1099.dat	upx
behavioral2/files/0x001900000002b3f8-1057.dat	upx
behavioral2/memory/2036-1310-0x00007FFD23A90000-0x00007FFD24082000-memory.dmp	upx
behavioral2/memory/2036-1343-0x00007FFD3A6E0000-0x00007FFD3A704000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe
File opened (read-only)	\??\VBoxMiniRdrDN	c.exe
File opened (read-only)	\??\VBoxMiniRdrDN	SecurityHealthService.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001a00000002b3bf-12.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	c.exe

Kills process with taskkill 3 IoCs

pid	Process
4028	taskkill.exe
3052	taskkill.exe
2152	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3896	schtasks.exe
3868	schtasks.exe
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3840	powershell.exe
3840	powershell.exe
816	c.exe
816	c.exe
1688	powershell.exe
1688	powershell.exe
3204	powershell.exe
3204	powershell.exe
4004	powershell.exe
4004	powershell.exe
3728	powershell.exe
3728	powershell.exe
1136	powershell.exe
1136	powershell.exe
4404	powershell.exe
4404	powershell.exe
428	powershell.exe
428	powershell.exe
2452	powershell.exe
2452	powershell.exe
1952	powershell.exe
1952	powershell.exe
4612	SecurityHealthService.exe
4612	SecurityHealthService.exe
3476	powershell.exe
3680	powershell.exe
1544	SecurityHealthService.exe
1544	SecurityHealthService.exe
3476	powershell.exe
1460	powershell.exe
1460	powershell.exe
3680	powershell.exe
3680	powershell.exe
1460	powershell.exe
408	powershell.exe
3004	powershell.exe
3004	powershell.exe
408	powershell.exe
408	powershell.exe
3004	powershell.exe
1464	powershell.exe
868	powershell.exe
868	powershell.exe
1444	powershell.exe
1464	powershell.exe
1444	powershell.exe
3328	powershell.exe
3328	powershell.exe
1652	powershell.exe
1652	powershell.exe
4468	powershell.exe
4468	powershell.exe
1652	powershell.exe
4468	powershell.exe
4160	powershell.exe
4160	powershell.exe
4728	powershell.exe
4728	powershell.exe
488	powershell.exe
488	powershell.exe
2116	powershell.exe
2116	powershell.exe
1472	powershell.exe
1472	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	c.exe
Token: SeDebugPrivilege	3772	tasklist.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeIncreaseQuotaPrivilege	3840	powershell.exe
Token: SeSecurityPrivilege	3840	powershell.exe
Token: SeTakeOwnershipPrivilege	3840	powershell.exe
Token: SeLoadDriverPrivilege	3840	powershell.exe
Token: SeSystemProfilePrivilege	3840	powershell.exe
Token: SeSystemtimePrivilege	3840	powershell.exe
Token: SeProfSingleProcessPrivilege	3840	powershell.exe
Token: SeIncBasePriorityPrivilege	3840	powershell.exe
Token: SeCreatePagefilePrivilege	3840	powershell.exe
Token: SeBackupPrivilege	3840	powershell.exe
Token: SeRestorePrivilege	3840	powershell.exe
Token: SeShutdownPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeSystemEnvironmentPrivilege	3840	powershell.exe
Token: SeRemoteShutdownPrivilege	3840	powershell.exe
Token: SeUndockPrivilege	3840	powershell.exe
Token: SeManageVolumePrivilege	3840	powershell.exe
Token: 33	3840	powershell.exe
Token: 34	3840	powershell.exe
Token: 35	3840	powershell.exe
Token: 36	3840	powershell.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeIncreaseQuotaPrivilege	1688	powershell.exe
Token: SeSecurityPrivilege	1688	powershell.exe
Token: SeTakeOwnershipPrivilege	1688	powershell.exe
Token: SeLoadDriverPrivilege	1688	powershell.exe
Token: SeSystemProfilePrivilege	1688	powershell.exe
Token: SeSystemtimePrivilege	1688	powershell.exe
Token: SeProfSingleProcessPrivilege	1688	powershell.exe
Token: SeIncBasePriorityPrivilege	1688	powershell.exe
Token: SeCreatePagefilePrivilege	1688	powershell.exe
Token: SeBackupPrivilege	1688	powershell.exe
Token: SeRestorePrivilege	1688	powershell.exe
Token: SeShutdownPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeSystemEnvironmentPrivilege	1688	powershell.exe
Token: SeRemoteShutdownPrivilege	1688	powershell.exe
Token: SeUndockPrivilege	1688	powershell.exe
Token: SeManageVolumePrivilege	1688	powershell.exe
Token: 33	1688	powershell.exe
Token: 34	1688	powershell.exe
Token: 35	1688	powershell.exe
Token: 36	1688	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeIncreaseQuotaPrivilege	3204	powershell.exe
Token: SeSecurityPrivilege	3204	powershell.exe
Token: SeTakeOwnershipPrivilege	3204	powershell.exe
Token: SeLoadDriverPrivilege	3204	powershell.exe
Token: SeSystemProfilePrivilege	3204	powershell.exe
Token: SeSystemtimePrivilege	3204	powershell.exe
Token: SeProfSingleProcessPrivilege	3204	powershell.exe
Token: SeIncBasePriorityPrivilege	3204	powershell.exe
Token: SeCreatePagefilePrivilege	3204	powershell.exe
Token: SeBackupPrivilege	3204	powershell.exe
Token: SeRestorePrivilege	3204	powershell.exe
Token: SeShutdownPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeSystemEnvironmentPrivilege	3204	powershell.exe
Token: SeRemoteShutdownPrivilege	3204	powershell.exe
Token: SeUndockPrivilege	3204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4324	3760	cardgenfix.exe	80
PID 3760 wrote to memory of 1396	3760	cardgenfix.exe	81
PID 1396 wrote to memory of 2036	1396	e.exe	83
PID 2036 wrote to memory of 2856	2036	e.exe	84
PID 2036 wrote to memory of 3088	2036	e.exe	85
PID 2036 wrote to memory of 3056	2036	e.exe	86
PID 4324 wrote to memory of 816	4324	c.exe	87
PID 816 wrote to memory of 3968	816	c.exe	88
PID 816 wrote to memory of 3772	816	c.exe	90
PID 816 wrote to memory of 3840	816	c.exe	93
PID 816 wrote to memory of 2820	816	c.exe	95
PID 816 wrote to memory of 1688	816	c.exe	97
PID 816 wrote to memory of 3204	816	c.exe	99
PID 816 wrote to memory of 4004	816	c.exe	101
PID 816 wrote to memory of 3684	816	c.exe	103
PID 816 wrote to memory of 3728	816	c.exe	105
PID 816 wrote to memory of 3192	816	c.exe	107
PID 816 wrote to memory of 1136	816	c.exe	109
PID 816 wrote to memory of 4404	816	c.exe	111
PID 816 wrote to memory of 2732	816	c.exe	113
PID 816 wrote to memory of 428	816	c.exe	115
PID 816 wrote to memory of 2452	816	c.exe	117
PID 816 wrote to memory of 1688	816	c.exe	119
PID 1688 wrote to memory of 1648	1688	cmd.exe	121
PID 816 wrote to memory of 1524	816	c.exe	122
PID 816 wrote to memory of 432	816	c.exe	125
PID 432 wrote to memory of 1104	432	cmd.exe	128
PID 816 wrote to memory of 2208	816	c.exe	129
PID 816 wrote to memory of 2140	816	c.exe	131
PID 816 wrote to memory of 3944	816	c.exe	134
PID 816 wrote to memory of 3388	816	c.exe	137
PID 2796 wrote to memory of 4612	2796	SecurityHealthService.exe	139
PID 816 wrote to memory of 3304	816	c.exe	140
PID 4612 wrote to memory of 2324	4612	SecurityHealthService.exe	164
PID 816 wrote to memory of 3348	816	c.exe	186
PID 1812 wrote to memory of 1544	1812	SecurityHealthService.exe	146
PID 1544 wrote to memory of 1040	1544	SecurityHealthService.exe	147
PID 816 wrote to memory of 2580	816	c.exe	149
PID 816 wrote to memory of 1952	816	c.exe	151
PID 4612 wrote to memory of 4056	4612	SecurityHealthService.exe	153
PID 816 wrote to memory of 2380	816	c.exe	155
PID 2380 wrote to memory of 4364	2380	cmd.exe	189
PID 1544 wrote to memory of 3692	1544	SecurityHealthService.exe	157
PID 4612 wrote to memory of 3476	4612	SecurityHealthService.exe	159
PID 816 wrote to memory of 3680	816	c.exe	161
PID 1544 wrote to memory of 1460	1544	SecurityHealthService.exe	163
PID 4612 wrote to memory of 408	4612	SecurityHealthService.exe	165
PID 816 wrote to memory of 4028	816	c.exe	167
PID 1544 wrote to memory of 3004	1544	SecurityHealthService.exe	168
PID 816 wrote to memory of 3340	816	c.exe	171
PID 816 wrote to memory of 3048	816	c.exe	235
PID 816 wrote to memory of 3664	816	c.exe	324
PID 816 wrote to memory of 1464	816	c.exe	252
PID 1544 wrote to memory of 1444	1544	SecurityHealthService.exe	179
PID 4612 wrote to memory of 868	4612	SecurityHealthService.exe	356
PID 816 wrote to memory of 2560	816	c.exe	396
PID 4612 wrote to memory of 1408	4612	SecurityHealthService.exe	553
PID 816 wrote to memory of 4600	816	c.exe	187
PID 816 wrote to memory of 3328	816	c.exe	488
PID 4600 wrote to memory of 4364	4600	cmd.exe	571
PID 1544 wrote to memory of 1248	1544	SecurityHealthService.exe	191
PID 4612 wrote to memory of 4468	4612	SecurityHealthService.exe	587
PID 1544 wrote to memory of 1652	1544	SecurityHealthService.exe	542
PID 816 wrote to memory of 3028	816	c.exe	415

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cardgenfix.exe
"C:\Users\Admin\AppData\Local\Temp\cardgenfix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\c.exe
  "C:\Users\Admin\AppData\Local\Temp\c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\c.exe
    "C:\Users\Admin\AppData\Local\Temp\c.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Enumerates VirtualBox DLL files
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VirtualBox drivers on disk
    - Looks for VMWare Tools registry key
    - Looks for VMWare drivers on disk
    - Looks for VMWare services registry key.
    - Drops startup file
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3968
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3840
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4004
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
      4⤵
      PID:3684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3728
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:3192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4404
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path Win32_PnPEntity get Name,DeviceID /format:csv
      4⤵
      PID:2732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        Enumerates processes with tasklist
        
        PID:1648
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "STATUS eq Running" /FO CSV /NH
        5⤵
        
        PID:1104
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {bootmgr} displaybootmenu no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2208
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2140
  - - C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /set {current} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3944
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3388
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3304
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3348
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1952
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3680
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /f /pid 4364
      4⤵
      Kills process with taskkill
      PID:4028
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3340
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3048
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1464
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2560
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3028
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1336
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2824
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1264
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2368
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1716
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3048
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1736
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1908
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1800
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4000
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4156
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3784
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:560
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
      4⤵
      PID:2004
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:488
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4452
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1212
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2912
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:920
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:796
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2184
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3372
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2244
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3288
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3480
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4492
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4648
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3996
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1716
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4920
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2920
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2244
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4632
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3136
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4276
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4728
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3680
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3664
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2500
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1572
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:812
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2880
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4740
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2612
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3284
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2216
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3332
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      PID:2016
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2464
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3616
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2644
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4776
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      PID:1912
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:3028
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:1548
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4756
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3832
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3964
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1208
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4212
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5036
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3756
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2888
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3692
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:796
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1408
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4024
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1716
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3176
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4244
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:1624
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:4776
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:3184
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
        5⤵
        
        PID:3304
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4364
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4900
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2484
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4364
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1736
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4688
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3564
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1140
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4040
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4636
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4556
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2496
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4256
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3776
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4832
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4476
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4436
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3340
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3344
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:812
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1104
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2304
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4000
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3528
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2184
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5084
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4156
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3572
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3268
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3500
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2676
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4436
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4556
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3112
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4008
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1324
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4052
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2328
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:488
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3728
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2972
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4492
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4560
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3500
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:492
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:568
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2836
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2496
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1732
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2244
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2544
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3048
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4416
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2076
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1656
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1104
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1036
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4880
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3968
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3832
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4160
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2484
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1944
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3944
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2184
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2908
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3376
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4860
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2820
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2744
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:772
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4468
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2416
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1404
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4228
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2764
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4692
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1456
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2912
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3328
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4240
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4552
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1116
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1684
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3344
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4616
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2368
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4984
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3680
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2008
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:972
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      PID:2004
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1212
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2076
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4552
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1572
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1136
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3376
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2660
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3356
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4076
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1988
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3036
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2780
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1032
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4704
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2524
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:808
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2328
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3984
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1216
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3112
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1652
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4616
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3944
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2136
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1704
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4040
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1560
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2820
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3392
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4000
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3212
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:840
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2824
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1004
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:796
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3684
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4664
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3180
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:1444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2568
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3980
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1248
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2904
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2260
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3212
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4728
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3684
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2884
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4560
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3064
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4760
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3436
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:792
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4624
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2972
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4664
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2708
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:196
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2276
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1928
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1808
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3896
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4984
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4636
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3680
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1136
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3440
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1896
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1488
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1912
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2568
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2236
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1996
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3480
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1980
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1560
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:920
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1004
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3172
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4088
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4076
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:772
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3212
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2772
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:636
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1472
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2764
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:2236
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4636
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4616
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5044
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3900
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:5088
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:2184
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4296
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1952
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4476
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3532
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3924
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2904
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:3728
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1472
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3532
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:4900
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:5084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:1520
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:2884
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3980
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3192
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2792
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:1032
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2836
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:3976
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2008
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:4120
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:928
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /query /tn MicrosoftSecurityHealthService
      4⤵
      PID:3084
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:2012
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /fi "imagename eq wscript.exe" /fo csv /nh
      4⤵
      PID:4556
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic process where name='wscript.exe' get commandline /format:list
      4⤵
      PID:3356
- C:\Users\Admin\AppData\Local\Temp\e.exe
  "C:\Users\Admin\AppData\Local\Temp\e.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\e.exe
    "C:\Users\Admin\AppData\Local\Temp\e.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title CARD GEN
      4⤵
      PID:2856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3056

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe"
  2⤵
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Drops startup file
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2324
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:868
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1408
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:488
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_PnPEntity get Name,DeviceID /format:csv
    3⤵
    PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path SoftwareLicensingProduct where ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' get LicenseStatus /format:csv
    3⤵
    PID:2752
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:1132
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:868
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:1660
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2076
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4644
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1212
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3112
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2560
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3192
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3696
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4404
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4996
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2184
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2752
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 1548
    3⤵
    - Kills process with taskkill
    PID:2152
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4584
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:5032
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1252
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3996
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4564
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1108
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:2268
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:412
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1652
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3784
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:1192
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1560
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
    3⤵
    PID:4764
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4220
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1996
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3500
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4468
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    - Enumerates processes with tasklist
    PID:3540
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3004
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1600
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1140
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4444
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2836
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:972
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1324
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1944
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4764
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1948
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5084
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1996
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4056
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:812
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4120
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:2884
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4088
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2772
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:588
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1264
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:396
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2184
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2544
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4376
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3384
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3756
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4444
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2016
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1660
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:580
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1684
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:2416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4228
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1944
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:3376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2524
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4860
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2328
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1248
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:776
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3728
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3228
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3976
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3500
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1660
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2500
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4116
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4492
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3976
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3048
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3500
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4944
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2236
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2260
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:228
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2112
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2032
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3944
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:3684
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:472
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:580
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:232
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1912
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4560
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5008
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3500
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1444
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3332
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4860
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4244
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3684
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:228
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2136
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1404
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1896
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4240
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4632
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4560
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:840
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1952
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4688
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3212
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:4228
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2884
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1068
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4812
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4728
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4868
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:580
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4088
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4632
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3332
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2824
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5064
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4052
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4852
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3332
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3964
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1404
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3500
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4444
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3692
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:4880
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:4556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1660
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3344
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2496
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:228
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1952
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1992
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4556
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4052
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:472
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:4756
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1324
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2792
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3696
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4616
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2076
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2904
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4304
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:920
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3372
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2772
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5008
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1332
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2484
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3796
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4880
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1004
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3572
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:468
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4860
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1216
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4740
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1036
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2200
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1988
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4332
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1212
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3180
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2672
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1860
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1072
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5108
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3776
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3480
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3784
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5044
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3284
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1032
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2464
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4556
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3836
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1068
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3052
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2188
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5100
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1488
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:588
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5044
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3696
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2672
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3832
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4276
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:636
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4768

C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates VirtualBox DLL files
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Drops startup file
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1040
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Model,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BIOS | Select-Object SMBIOSBIOSVersion,SerialNumber | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_BaseBoard | Select-Object Product,Manufacturer | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1444
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_BaseBoard get Product,Manufacturer /format:csv
    3⤵
    PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object Model | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:2692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_VideoController | Select-Object Name | Format-List"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_PnPEntity | Select-Object Name,DeviceID | Format-List"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path Win32_PnPEntity get Name,DeviceID /format:csv
    3⤵
    PID:1956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object UUID | Format-List"
    3⤵
    PID:3312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName SoftwareLicensingProduct -Filter \"ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f'\" | Select-Object LicenseStatus | Format-List"
    3⤵
    PID:4528
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:4540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:2732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn MicrosoftSecurityHealthService /tr C:\Users\Admin\AppData\Local\Microsoft\WindowsHealth\SecurityHealthService.exe /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FI "STATUS eq Running" /FO CSV /NH"
    3⤵
    PID:4884
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "STATUS eq Running" /FO CSV /NH
      4⤵
      PID:4304
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {bootmgr} displaybootmenu no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4468
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1208
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2820
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5052
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3332
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4648
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4312
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2676
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,BehaviorMonitorEnabled,NISEnabled | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4704
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1492
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3996
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName,productState | ConvertTo-Json"
    3⤵
    PID:412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /pid 4364
    3⤵
    - Kills process with taskkill
    PID:3052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3996
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3288
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4740
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4712
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4852
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe"
    3⤵
    PID:1980
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1108
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2484
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:220
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:3356
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4644
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4740
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:3616
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:3024
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3776
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2436
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4480
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1520
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object -ExpandProperty CommandLine"
    3⤵
    PID:3356
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:1336
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:1408
- - C:\Windows\system32\cmd.exe
    cmd.exe /c start "" /min wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
    3⤵
    PID:1432
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B C:\Users\Admin\AppData\Local\Microsoft\RuntimeBroker\monitor.vbs
      4⤵
      PID:4660
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4168
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3648
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2304
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1472
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5088
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3796
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3192
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4812
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4860
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2244
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:472
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:3604
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4160
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4244
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5040
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3340
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3540
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4756
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4304
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4364
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2416
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4712
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3480
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4632
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2824
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:808
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4768
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1032
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:3964
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:792
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2744
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3500
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1860
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1780
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1452
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2660
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2016
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1732
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:636
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4944
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2992
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3344
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4556
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:468
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4256
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4304
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2244
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4168
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1600
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4832
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3728
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4716
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4016
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:1116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:472
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1988
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3680
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4728
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1412
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4468
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4976
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2368
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4116
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2516
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2004
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2992
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2920
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4444
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3976
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2884
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4296
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2312
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3976
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4024
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5036
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:1104
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3464
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2504
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3192
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2912
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2004
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1896
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4436
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1676
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1104
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4008
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2500
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1332
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:920
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3784
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2116
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3264
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1980
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:5088
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4896
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3328
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2260
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2016
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4368
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4052
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3784
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3896
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1736
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3476
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1472
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3052
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2500
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2304
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1928
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3180
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1996
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3984
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2672
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3380
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2244
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3532
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3944
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5052
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1912
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4688
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2436
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4616
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1996
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2008
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:492
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1520
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3780
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4156
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:5036
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:4692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2096
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:972
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3040
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1560
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:5044
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4240
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3332
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2516
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2236
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:2496
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4244
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3936
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1488
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4468
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4832
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2328
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4812
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3180
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:580
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1980
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4008
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:2076
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3896
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4120
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4816
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2744
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:3780
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:3820
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1212
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3172
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4552
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1248
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    PID:1300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:808
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4616
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:1252
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1684
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2672
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    PID:2180
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -ep bypass -w hidden -c "Get-CimInstance -ClassName Win32_Process | Select-Object Name | Format-List"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4040
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:3356
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4896
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:4160
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:2516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4860
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:4984
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Select-Object ProcessId,CommandLine | ConvertTo-Json -Compress"
    3⤵
    PID:3756
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:492
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn MicrosoftSecurityHealthService
    3⤵
    PID:2792
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where name='wscript.exe' get commandline /format:list
    3⤵
    PID:1676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq wscript.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

File and Directory Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion