183a607b65feaed792324f6568d2c936406e95a8d30a2baee6beae77e4cbd84d

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
Size 6.9MB
Sample260803-ckjmtazzhw
SHA256 183a607b65feaed792324f6568d2c936406e95a8d30a2baee6beae77e4cbd84d
MD5 dd153a337935bcacaf4a596567224733
SHA1 d520f62c29a00863323d4aab253fd2bd73c80f18
SHA512 b27acc7fbb2844f713d563b530c6146d1477af069a9b02c57c3c4debd1066f3e84f31d7d039d72ae1aa6f4e93981090217ad1421a7b4d6a8b2cc8285905e64d4
SSDEEP 49152:cP2FDMofKZ7UvUp+fHYAkDtnDSbz2J0jw0psci0IMKJBOdPbY4o293ALwPuYdH3p:cPQomiELK9rUQ8PuY9L79Ey
TLSH
T191764907EC6554E9C0AED93489639517BFA17C4A4B2163D72F90F6243FB6BE0AE79300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	7116	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	4500	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe
Token: SeDebugPrivilege	6580	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 7116	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	88
PID 4560 wrote to memory of 4500	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	90
PID 4560 wrote to memory of 6580	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	92
PID 4560 wrote to memory of 3576	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	94
PID 4560 wrote to memory of 1972	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	96
PID 4560 wrote to memory of 4476	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	98
PID 4560 wrote to memory of 7132	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	100
PID 4560 wrote to memory of 4112	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	103
PID 4560 wrote to memory of 1128	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	105
PID 4560 wrote to memory of 3828	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	107
PID 4560 wrote to memory of 6892	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	109
PID 4560 wrote to memory of 5400	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	111
PID 4560 wrote to memory of 2024	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	113
PID 4560 wrote to memory of 5164	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	115
PID 4560 wrote to memory of 5448	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	117
PID 4560 wrote to memory of 4120	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	119
PID 4560 wrote to memory of 4356	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	121
PID 4560 wrote to memory of 3008	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	123
PID 4560 wrote to memory of 6808	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	125
PID 4560 wrote to memory of 3708	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	127
PID 4560 wrote to memory of 1964	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	129
PID 4560 wrote to memory of 4412	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	131
PID 4560 wrote to memory of 6812	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	133
PID 4560 wrote to memory of 6616	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	135
PID 4560 wrote to memory of 3700	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	137
PID 4560 wrote to memory of 560	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	139
PID 4560 wrote to memory of 5200	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	141
PID 4560 wrote to memory of 4836	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	143
PID 4560 wrote to memory of 1056	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	145
PID 4560 wrote to memory of 3668	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	147
PID 4560 wrote to memory of 3536	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	149
PID 4560 wrote to memory of 780	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	151
PID 4560 wrote to memory of 860	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	153
PID 4560 wrote to memory of 6348	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	155
PID 4560 wrote to memory of 4616	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	157
PID 4560 wrote to memory of 5396	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	159
PID 4560 wrote to memory of 3952	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	161
PID 4560 wrote to memory of 4928	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	163
PID 4560 wrote to memory of 1232	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	165
PID 4560 wrote to memory of 6096	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	167
PID 4560 wrote to memory of 2128	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	169
PID 4560 wrote to memory of 6564	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	171
PID 4560 wrote to memory of 5644	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	173
PID 4560 wrote to memory of 2952	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	175
PID 4560 wrote to memory of 5040	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	177
PID 4560 wrote to memory of 5600	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	179
PID 4560 wrote to memory of 3164	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	181
PID 4560 wrote to memory of 4600	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	183
PID 4560 wrote to memory of 5256	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	185
PID 4560 wrote to memory of 7076	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	187
PID 4560 wrote to memory of 6272	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	189
PID 4560 wrote to memory of 5060	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	191
PID 4560 wrote to memory of 2976	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	193
PID 4560 wrote to memory of 2620	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	195
PID 4560 wrote to memory of 2912	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	197
PID 4560 wrote to memory of 6868	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	199
PID 4560 wrote to memory of 2664	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	201
PID 4560 wrote to memory of 6296	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	203
PID 4560 wrote to memory of 1488	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	205
PID 4560 wrote to memory of 6824	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	207
PID 4560 wrote to memory of 4532	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	209
PID 4560 wrote to memory of 2416	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	211
PID 4560 wrote to memory of 4120	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	213
PID 4560 wrote to memory of 4688	4560	2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd153a337935bcacaf4a596567224733_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4476
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4356
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6808
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6812
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:860
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6348
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5396
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4928
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1232
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5256
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6868
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:904
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7028
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5996
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3656
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5812
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6496
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4248
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4528
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3192
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5444
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4304
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6348
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3192
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3476
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2264
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5256
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4476
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4256
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1636
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1496
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2840
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7028
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6860
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3188
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3332
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5028
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5928
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6456
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5188
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3308
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6904
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4264
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3300
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2544
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6520
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6860
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5316
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:256
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1188
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5864
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6732
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6840
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1680
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1636
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2544
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6292
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6444
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1768
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6732
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6860
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5608
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6552
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4332
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4360
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:408
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6016
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6980
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2840
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4788
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4368
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5456
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1992
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4472
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4360
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6196
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5312
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5956
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6984
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4252
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6684
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5656
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5864
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5448
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4392
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6372
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5876
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4808
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3308
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4552
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3300
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2156
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2680
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4444
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6308
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6208
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1536
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4316
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2500
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4552
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1540
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3556
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1936
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5952
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2680
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1884
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1628
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5444
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3828
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1288
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5864
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6840
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4144
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3472
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6684
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6360
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6292
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:7060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1676
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4860
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2332
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4684
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4220
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6392
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3308
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3036
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5244
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4728
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1900
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2828

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads