c76da6639845045916dc08c8c6c3af5771352d204881257a807700582356b464

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe
Size 6.9MB
Sample260803-cft8rawdpc
SHA256 c76da6639845045916dc08c8c6c3af5771352d204881257a807700582356b464
MD5 fc65a037889d3239bc16ba6772737302
SHA1 5ffe790e5b8b959b6c503fba8db6e20db54445c3
SHA512 1e060b25ab47820b40497b0d9a1af63a64924986b357e98367e800bed5c4836e0bb2442a6cd6a3bfcd40a12b360dc3f9f5630841032d6749a3f6d428b3230fa5
SSDEEP 49152:3P2FDMofKZ7UvUp+fHYAkDtnDSbz2J0jw0psci0IMKJBOdPbY4o293ALwPuYdH3r:3PQomiELK9rUQ8PuY9L79Ek
TLSH
T17A764907EC6554E9C0AED93489639517BFA17C4A4B2163D72F90F6243FB6BE0AE79300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	3340	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1668	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe
Token: SeDebugPrivilege	1536	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3340	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	85
PID 1960 wrote to memory of 1668	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	87
PID 1960 wrote to memory of 1536	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	89
PID 1960 wrote to memory of 1784	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	91
PID 1960 wrote to memory of 4292	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	93
PID 1960 wrote to memory of 2128	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	95
PID 1960 wrote to memory of 4136	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	97
PID 1960 wrote to memory of 1992	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	99
PID 1960 wrote to memory of 4056	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	101
PID 1960 wrote to memory of 3816	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	103
PID 1960 wrote to memory of 2336	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	105
PID 1960 wrote to memory of 2888	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	107
PID 1960 wrote to memory of 5064	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	109
PID 1960 wrote to memory of 1204	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	111
PID 1960 wrote to memory of 4464	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	113
PID 1960 wrote to memory of 5100	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	115
PID 1960 wrote to memory of 4412	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	117
PID 1960 wrote to memory of 3184	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	119
PID 1960 wrote to memory of 3484	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	121
PID 1960 wrote to memory of 3620	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	123
PID 1960 wrote to memory of 3420	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	125
PID 1960 wrote to memory of 2316	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	127
PID 1960 wrote to memory of 1448	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	129
PID 1960 wrote to memory of 4152	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	131
PID 1960 wrote to memory of 3700	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	133
PID 1960 wrote to memory of 1820	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	135
PID 1960 wrote to memory of 3896	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	137
PID 1960 wrote to memory of 512	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	139
PID 1960 wrote to memory of 2512	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	141
PID 1960 wrote to memory of 4912	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	143
PID 1960 wrote to memory of 3888	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	145
PID 1960 wrote to memory of 536	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	147
PID 1960 wrote to memory of 540	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	149
PID 1960 wrote to memory of 4676	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	151
PID 1960 wrote to memory of 552	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	153
PID 1960 wrote to memory of 2876	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	155
PID 1960 wrote to memory of 3532	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	157
PID 1960 wrote to memory of 2956	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	159
PID 1960 wrote to memory of 3404	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	161
PID 1960 wrote to memory of 2828	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	163
PID 1960 wrote to memory of 1784	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	165
PID 1960 wrote to memory of 4292	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	167
PID 1960 wrote to memory of 2168	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	169
PID 1960 wrote to memory of 4800	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	171
PID 1960 wrote to memory of 3712	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	173
PID 1960 wrote to memory of 2368	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	175
PID 1960 wrote to memory of 4372	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	178
PID 1960 wrote to memory of 1748	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	180
PID 1960 wrote to memory of 3768	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	182
PID 1960 wrote to memory of 1072	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	184
PID 1960 wrote to memory of 4560	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	186
PID 1960 wrote to memory of 3660	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	188
PID 1960 wrote to memory of 1468	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	190
PID 1960 wrote to memory of 752	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	192
PID 1960 wrote to memory of 212	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	194
PID 1960 wrote to memory of 4924	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	196
PID 1960 wrote to memory of 2608	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	198
PID 1960 wrote to memory of 2704	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	200
PID 1960 wrote to memory of 2036	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	202
PID 1960 wrote to memory of 3704	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	204
PID 1960 wrote to memory of 2448	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	206
PID 1960 wrote to memory of 3624	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	208
PID 1960 wrote to memory of 4628	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	210
PID 1960 wrote to memory of 912	1960	2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe	213

C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc65a037889d3239bc16ba6772737302_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4292
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1204
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2316
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:552
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2956
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4292
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:212
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3016
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2188
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4476
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3864
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4500
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4236
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3232
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4472
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4392
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4476
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1156
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4520
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3304
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:8
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4456
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3928
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4300
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1236
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4812
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:208
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2028
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1156
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3304
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4908
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2028
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5088
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2496
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2308
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1732
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4904
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1144
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2340
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3232
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4456
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4236
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1144
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5088
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1808
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4520
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4196
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5088
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4236
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2496
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4300
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3256
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3304
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1788
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3864
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:208
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1332
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1788
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2956
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2264
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:392
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4392
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4500
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3340
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3444
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4904
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4016
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4236
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1156
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4500
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3208
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3908
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4156
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4904
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4908
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4380

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads