e0221bb14e377d6e97548956130d281efbe4ece56f0ec70a8c7c9e6d0a7ea8d1

Analysis

max time kernel
34s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SimbMin_debug12.exe
Size 5.8MB
Sample260711-fs92hset2v
SHA256 e0221bb14e377d6e97548956130d281efbe4ece56f0ec70a8c7c9e6d0a7ea8d1
MD5 e8abc2003bc37b3ef40c2127cd8c51c1
SHA1 ea551dbfc57afb6def01a5cc9805e7576fbae082
SHA512 6f1dcb918467a7fc024960ceb197c5888c99bf02d496bcee77b35afbbf7f71dca06296871152311826ba1c826fbec2a0f4df4912bc7f2d5de9fdefb96f02b32d
SSDEEP 98304:ZEFsTmzdsxdtyT70fv00Em9LTsiIlzocEGssgKbr3WvGESmcEK:ZHTOds50GQ8K
TLSH
T1CE565901FDCB54F6EA13093141A7B27F63386D068B25CBD7EB047A6AF9776911C3620A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5072	WindowsHost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimbMin = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost.exe"	WindowsHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimbMin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimbMin_debug12.exe"	SimbMin_debug12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimbMin = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsHost.exe"	SimbMin_debug12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimbMin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SimbMin_debug12.exe"	SimbMin_debug12.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
5248	tasklist.exe
3256	Process not Found
4264	Process not Found
3032	tasklist.exe
296	tasklist.exe
204	tasklist.exe
4840	tasklist.exe
3260	Process not Found
3232	Process not Found
3268	Process not Found
3760	tasklist.exe
3544	tasklist.exe
2084	tasklist.exe
3000	tasklist.exe
3828	tasklist.exe
1500	Process not Found
3772	Process not Found
4880	Process not Found
3932	tasklist.exe
2112	tasklist.exe
2476	Process not Found
5508	Process not Found
4116	tasklist.exe
4648	tasklist.exe
5420	tasklist.exe
2780	tasklist.exe
5552	tasklist.exe
1348	tasklist.exe
3252	Process not Found
3644	Process not Found
5756	tasklist.exe
4608	tasklist.exe
5856	tasklist.exe
3328	tasklist.exe
2988	tasklist.exe
4296	tasklist.exe
3228	tasklist.exe
5428	tasklist.exe
4124	tasklist.exe
1476	tasklist.exe
3804	tasklist.exe
3344	Process not Found
4208	tasklist.exe
2168	tasklist.exe
868	tasklist.exe
2648	tasklist.exe
5876	Process not Found
5424	Process not Found
5520	tasklist.exe
5876	tasklist.exe
4772	tasklist.exe
5184	tasklist.exe
2636	tasklist.exe
4544	Process not Found
5556	Process not Found
4876	tasklist.exe
1340	tasklist.exe
1612	tasklist.exe
1096	Process not Found
2888	Process not Found
4280	Process not Found
5276	Process not Found
5900	tasklist.exe
5056	tasklist.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimbMin_debug12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	1	Go-http-client/1.1
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	3	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	2888	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	4988	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	4472	tasklist.exe
Token: SeDebugPrivilege	868	tasklist.exe
Token: SeDebugPrivilege	1548	tasklist.exe
Token: SeDebugPrivilege	4932	tasklist.exe
Token: SeDebugPrivilege	2240	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	1832	tasklist.exe
Token: SeDebugPrivilege	1352	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	2988	tasklist.exe
Token: SeDebugPrivilege	4804	tasklist.exe
Token: SeDebugPrivilege	3060	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	6008	tasklist.exe
Token: SeDebugPrivilege	5516	tasklist.exe
Token: SeDebugPrivilege	5296	tasklist.exe
Token: SeDebugPrivilege	1464	tasklist.exe
Token: SeDebugPrivilege	3452	tasklist.exe
Token: SeDebugPrivilege	2104	tasklist.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	2040	tasklist.exe
Token: SeDebugPrivilege	1200	tasklist.exe
Token: SeDebugPrivilege	1524	tasklist.exe
Token: SeDebugPrivilege	4328	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	3384	tasklist.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	2864	tasklist.exe
Token: SeDebugPrivilege	5832	tasklist.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	3464	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	6060	tasklist.exe
Token: SeDebugPrivilege	1504	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	3572	tasklist.exe
Token: SeDebugPrivilege	5820	tasklist.exe
Token: SeDebugPrivilege	5636	tasklist.exe
Token: SeDebugPrivilege	460	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeDebugPrivilege	3352	tasklist.exe
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	5260	tasklist.exe
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	256	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe
Token: SeDebugPrivilege	2452	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 5072	3272	SimbMin_debug12.exe	88
PID 3272 wrote to memory of 4332	3272	SimbMin_debug12.exe	91
PID 5072 wrote to memory of 2008	5072	WindowsHost.exe	92
PID 3272 wrote to memory of 4280	3272	SimbMin_debug12.exe	94
PID 5072 wrote to memory of 2888	5072	WindowsHost.exe	95
PID 3272 wrote to memory of 5084	3272	SimbMin_debug12.exe	96
PID 5072 wrote to memory of 4988	5072	WindowsHost.exe	97
PID 3272 wrote to memory of 1484	3272	SimbMin_debug12.exe	98
PID 5072 wrote to memory of 4472	5072	WindowsHost.exe	99
PID 5132 wrote to memory of 868	5132	SimbMin_debug12.exe	100
PID 3272 wrote to memory of 1548	3272	SimbMin_debug12.exe	101
PID 5072 wrote to memory of 4932	5072	WindowsHost.exe	102
PID 5132 wrote to memory of 2240	5132	SimbMin_debug12.exe	103
PID 3272 wrote to memory of 1672	3272	SimbMin_debug12.exe	104
PID 5072 wrote to memory of 1068	5072	WindowsHost.exe	105
PID 5132 wrote to memory of 1832	5132	SimbMin_debug12.exe	106
PID 5132 wrote to memory of 1352	5132	SimbMin_debug12.exe	166
PID 3272 wrote to memory of 2300	3272	SimbMin_debug12.exe	108
PID 5072 wrote to memory of 2988	5072	WindowsHost.exe	109
PID 5072 wrote to memory of 4804	5072	WindowsHost.exe	110
PID 3272 wrote to memory of 3060	3272	SimbMin_debug12.exe	170
PID 5132 wrote to memory of 4104	5132	SimbMin_debug12.exe	112
PID 3272 wrote to memory of 6008	3272	SimbMin_debug12.exe	173
PID 5072 wrote to memory of 5516	5072	WindowsHost.exe	174
PID 5132 wrote to memory of 5296	5132	SimbMin_debug12.exe	115
PID 3272 wrote to memory of 1464	3272	SimbMin_debug12.exe	175
PID 5072 wrote to memory of 3452	5072	WindowsHost.exe	117
PID 5132 wrote to memory of 2104	5132	SimbMin_debug12.exe	118
PID 3272 wrote to memory of 5344	3272	SimbMin_debug12.exe	119
PID 5072 wrote to memory of 2040	5072	WindowsHost.exe	120
PID 5132 wrote to memory of 1200	5132	SimbMin_debug12.exe	121
PID 3272 wrote to memory of 1524	3272	SimbMin_debug12.exe	122
PID 5072 wrote to memory of 4328	5072	WindowsHost.exe	123
PID 5132 wrote to memory of 2984	5132	SimbMin_debug12.exe	240
PID 3272 wrote to memory of 4864	3272	SimbMin_debug12.exe	185
PID 5072 wrote to memory of 1900	5072	WindowsHost.exe	126
PID 5132 wrote to memory of 3384	5132	SimbMin_debug12.exe	127
PID 3272 wrote to memory of 4936	3272	SimbMin_debug12.exe	128
PID 5072 wrote to memory of 4900	5072	WindowsHost.exe	188
PID 5132 wrote to memory of 5008	5132	SimbMin_debug12.exe	130
PID 3272 wrote to memory of 4732	3272	SimbMin_debug12.exe	131
PID 5072 wrote to memory of 3648	5072	WindowsHost.exe	245
PID 5132 wrote to memory of 2864	5132	SimbMin_debug12.exe	133
PID 3272 wrote to memory of 5832	3272	SimbMin_debug12.exe	134
PID 5072 wrote to memory of 3160	5072	WindowsHost.exe	135
PID 5132 wrote to memory of 3464	5132	SimbMin_debug12.exe	136
PID 3272 wrote to memory of 5024	3272	SimbMin_debug12.exe	137
PID 5072 wrote to memory of 6060	5072	WindowsHost.exe	138
PID 5132 wrote to memory of 1504	5132	SimbMin_debug12.exe	139
PID 3272 wrote to memory of 4088	3272	SimbMin_debug12.exe	140
PID 5072 wrote to memory of 3572	5072	WindowsHost.exe	141
PID 5132 wrote to memory of 5820	5132	SimbMin_debug12.exe	142
PID 3272 wrote to memory of 5636	3272	SimbMin_debug12.exe	308
PID 5072 wrote to memory of 460	5072	WindowsHost.exe	203
PID 5132 wrote to memory of 3352	5132	SimbMin_debug12.exe	145
PID 3272 wrote to memory of 3124	3272	SimbMin_debug12.exe	357
PID 5072 wrote to memory of 5004	5072	WindowsHost.exe	147
PID 5132 wrote to memory of 5260	5132	SimbMin_debug12.exe	148
PID 3272 wrote to memory of 2820	3272	SimbMin_debug12.exe	149
PID 5072 wrote to memory of 4496	5072	WindowsHost.exe	150
PID 5132 wrote to memory of 4812	5132	SimbMin_debug12.exe	151
PID 3272 wrote to memory of 256	3272	SimbMin_debug12.exe	152
PID 5072 wrote to memory of 2008	5072	WindowsHost.exe	421
PID 5132 wrote to memory of 2388	5132	SimbMin_debug12.exe	154

C:\Users\Admin\AppData\Local\Temp\SimbMin_debug12.exe
"C:\Users\Admin\AppData\Local\Temp\SimbMin_debug12.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Roaming\WindowsHost.exe
  C:\Users\Admin\AppData\Roaming\WindowsHost.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    PID:5756
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3832
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq WindowsHost.exe" /NH
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:6068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:96
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:760
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5904
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:6132
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4472
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:468
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4156
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:832
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:476
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5636
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:868
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5420
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5236
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:620
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3544
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5320
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4424
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4312
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3960
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3228
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:800
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5056
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:6132
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:600
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:2648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:200
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3872
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4608
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5404
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5452
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:564
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:5876
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3232
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5756
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:236
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:504
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5320
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:6084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3964
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:3032
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3712
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3868
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:296
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:668
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:248
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:5308
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
    3⤵
    - Enumerates processes with tasklist
    PID:4840
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
    3⤵
    PID:852
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
    3⤵
    PID:96
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:256
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1564
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4384
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3232
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5400
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3944
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4912
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4120
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4928
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4864
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1724
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq SimbMin_debug12.exe" /NH
  2⤵
  PID:2428
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:460
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3288
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4580
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4292
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1780
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1068
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1784
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5844
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5528
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4912
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5264
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3412
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5564
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3648
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1848
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3000
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1940
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4108
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2880
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2300
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5516
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3760
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5760
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3844
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:832
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:992
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5384
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3664
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5388
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3044
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4380
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6076
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2840
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5028
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1980
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1816
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4156
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1220
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5988
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3524
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4544
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:852
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4384
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3716
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6056
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2664
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4948
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2892
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5160
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:620
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4752
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3328
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3676
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:96
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4648
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4380
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5304
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5248
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4524
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1936
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3016
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3844
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1508
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3908
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4996
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3268
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5384
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5740
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:852
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:1340
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2972
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1612
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:2780
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3372
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4928
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1600
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1356
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3148
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5260
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3156
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5268
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:708
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2416
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4672
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3380
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2928
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4332
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2616
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2924
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:1348
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6088
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4528
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4236
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1400
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:460
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:940
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5968
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3144
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5268
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:6084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4472
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:868
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5360
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1464
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:6008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5344
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5948
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1476
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3432
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5988
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:996
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4112
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4448
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3168
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4656
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3584
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1340
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1612
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5876
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6112
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1548
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:804
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5428
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1312
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5684
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4508
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5724
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1872
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2052
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4324
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5968
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3144
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:564
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3856
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3752
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:6076
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5652
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4072
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3552
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2984
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:996
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3000
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5256
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4448
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4656
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3128
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2072
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2992
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5432
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3232
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5040
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5520
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1680
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5756
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:6000
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1052
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2596
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3328
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4080
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2724
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4292
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2196
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4772
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1644
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1412
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3828
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3420
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4528
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:1476
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3872
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4108
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5300
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:476
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4496
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4764
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:264
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3544
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3156
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4512
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5184
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3336
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5960
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2536
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4892
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5924
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2684
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5968
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2828
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2888
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3804
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:760
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5944
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5860
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6064
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2996
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1068
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3440
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1220
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:920
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1832
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3412
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4460
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5756
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6044
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4476
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:96
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:204
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5420
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5116
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4608
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5688
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5448
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5520
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4928
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3960
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1312
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5660
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4176
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4456
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4736
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:760
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3228
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3536
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4292
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:6096
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1320
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:2112
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5940
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2856
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3004
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2068
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6088
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4640
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1616
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5256
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2360
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4656
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4488
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5860
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:248
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5184
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2616
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1372
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5776
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3660
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3552
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4556
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4640
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3344
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5592
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4424

C:\Users\Admin\AppData\Local\Temp\SimbMin_debug12.exe
C:\Users\Admin\AppData\Local\Temp\SimbMin_debug12.exe
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3384
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5340
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4684
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3120
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1464
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1776
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1608
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2456
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2292
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5504
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2408
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2108
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6032
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4208
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq SimbMin_debug12.exe" /NH
  2⤵
  PID:296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5332
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4664
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2724
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2840
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5400
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3512
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4808
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2704
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4116
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4876
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4380
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1068
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2840
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6112
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5624
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:200
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1608
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4640
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4236
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6044
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4652
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:852
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1340
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2080
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2300
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5376
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4524
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5040
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5308
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2408
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1848
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6000
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4456
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3044
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4512
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5420
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4436
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5804
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2788
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3372
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5612
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4964
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5732
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4660
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2168
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5312
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2908
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:4296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4732
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:992
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4424
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5300
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4536
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5268
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3232
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:948
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:504
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5248
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5312
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3760
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1680
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3076
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5160
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2108
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4336
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:620
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4592
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3676
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5740
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4876
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5332
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3684
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5904
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3480
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1952
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5552
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:200
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1816
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4296
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4864
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1600
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:6000
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5260
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1484
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2692
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4080
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2416
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4672
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1180
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3184
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1148
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:6076
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5200
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3620
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4508
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4520
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1184
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:460
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4652
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2424
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4876
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:6084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4616
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2240
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4380
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3472
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1292
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4072
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3432
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5592
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4592
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4496
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3348
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3712
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:868
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3468
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1148
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2924
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5364
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3360
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5784
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2108
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5724
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3908
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:236
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4208
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4764
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2352
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4596
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:1612
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1180
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3100
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2788
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2780
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4992
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5948
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3080
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3432
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1508
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:6044
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4476
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1484
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3712
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5856
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2648
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5184
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3360
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2932
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4072
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4600
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5024
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:596
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4748
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3584
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5116
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4132
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5488
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5624
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3060
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5376
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5824
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5236
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5988
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1312
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1508
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5088
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1848
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4252
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4764
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1112
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:1584
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4948
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5304
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:1816
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3232
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4624
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3944
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5832
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5796
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4520
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5404
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3676
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5900
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2876
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1128
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:3328
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4280
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5944
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3032
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5488
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4712
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5528
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5272
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5340
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4632
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:1680
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3412
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3956
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2820
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:3268
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:940
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:4496
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5452
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4588
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:4488
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2492
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3544
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5052
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2664
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2616
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:2884
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:768
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:2072
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3648
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5960
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4792
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5220
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3668
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:4996
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3676
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:6084
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:3720
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2416
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:3128
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:3156
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:2992
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:5488
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:2104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:5008
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5648
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  PID:1124
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:5696
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4104
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmgr.exe" /NH
  2⤵
  PID:5220
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TaskManager.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:2636
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq taskmanager.exe" /NH
  2⤵
  PID:596
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Taskmgr.exe" /NH
  2⤵
  PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsHost.exe
Size 5.8MB
SHA256 e0221bb14e377d6e97548956130d281efbe4ece56f0ec70a8c7c9e6d0a7ea8d1
MD5 e8abc2003bc37b3ef40c2127cd8c51c1
SHA1 ea551dbfc57afb6def01a5cc9805e7576fbae082
SHA512 6f1dcb918467a7fc024960ceb197c5888c99bf02d496bcee77b35afbbf7f71dca06296871152311826ba1c826fbec2a0f4df4912bc7f2d5de9fdefb96f02b32d
SSDEEP 98304:ZEFsTmzdsxdtyT70fv00Em9LTsiIlzocEGssgKbr3WvGESmcEK:ZHTOds50GQ8K
TLSH
T1CE565901FDCB54F6EA13093141A7B27F63386D068B25CBD7EB047A6AF9776911C3620A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads