c648d1f6d9e2e0c00b4cdfdd04b35a1948b2204e86cddd766395bc27b5f71124

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
Size 6.9MB
Sample260806-bdgzzazfrc
SHA256 c648d1f6d9e2e0c00b4cdfdd04b35a1948b2204e86cddd766395bc27b5f71124
MD5 f7176aa0ddaad5624c5fe5d5a00000d3
SHA1 0a23016cefd05e6d5825ed1db9f39a8541f15079
SHA512 1db6a430d50a3a601a5d02da2412c69ec4eb62c96aa5f1db86c631f709433816820883cd1f2d5600d411840c7cd95fe461327dfa1edd0fac57cbef1aa6dc17b0
SSDEEP 49152:rlkJXWqYbK5qCMt92c1t9Ed/CeNT+qxCK0sa3QyhNQyptapwG51yQzzmnlMm1IHo:rlSGPEjTRkMwSUMmM4A0ZlEwd
TLSH
T1DA764907F8A505E8C1EDD93889639653BF617C4A4B2123D32B90F6283F76BE0AD79744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	2228	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	1512	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe
Token: SeDebugPrivilege	5480	whoami.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2228	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	89
PID 3328 wrote to memory of 1512	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	91
PID 3328 wrote to memory of 5480	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	93
PID 3328 wrote to memory of 4492	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	95
PID 3328 wrote to memory of 4100	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	97
PID 3328 wrote to memory of 1580	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	99
PID 3328 wrote to memory of 4988	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	101
PID 3328 wrote to memory of 1280	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	103
PID 3328 wrote to memory of 5548	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	105
PID 3328 wrote to memory of 4076	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	107
PID 3328 wrote to memory of 4956	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	109
PID 3328 wrote to memory of 1656	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	111
PID 3328 wrote to memory of 2184	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	232
PID 3328 wrote to memory of 2560	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	115
PID 3328 wrote to memory of 5024	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	117
PID 3328 wrote to memory of 4792	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	119
PID 3328 wrote to memory of 3132	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	121
PID 3328 wrote to memory of 5040	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	123
PID 3328 wrote to memory of 5564	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	125
PID 3328 wrote to memory of 4892	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	127
PID 3328 wrote to memory of 5240	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	129
PID 3328 wrote to memory of 1084	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	131
PID 3328 wrote to memory of 5660	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	251
PID 3328 wrote to memory of 5616	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	253
PID 3328 wrote to memory of 3844	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	198
PID 3328 wrote to memory of 4668	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	139
PID 3328 wrote to memory of 2960	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	141
PID 3328 wrote to memory of 1112	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	143
PID 3328 wrote to memory of 5868	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	145
PID 3328 wrote to memory of 5600	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	267
PID 3328 wrote to memory of 3048	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	149
PID 3328 wrote to memory of 972	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	271
PID 3328 wrote to memory of 3112	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	153
PID 3328 wrote to memory of 6076	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	273
PID 3328 wrote to memory of 1748	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	157
PID 3328 wrote to memory of 1184	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	219
PID 3328 wrote to memory of 200	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	161
PID 3328 wrote to memory of 4148	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	223
PID 3328 wrote to memory of 2088	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	165
PID 3328 wrote to memory of 4320	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	167
PID 3328 wrote to memory of 4072	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	169
PID 3328 wrote to memory of 4204	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	171
PID 3328 wrote to memory of 4564	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	173
PID 3328 wrote to memory of 2396	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	236
PID 3328 wrote to memory of 1352	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	238
PID 3328 wrote to memory of 6080	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	179
PID 3328 wrote to memory of 4724	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	181
PID 3328 wrote to memory of 2736	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	244
PID 3328 wrote to memory of 6024	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	306
PID 3328 wrote to memory of 3920	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	310
PID 3328 wrote to memory of 5872	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	312
PID 3328 wrote to memory of 5656	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	191
PID 3328 wrote to memory of 2040	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	315
PID 3328 wrote to memory of 1668	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	195
PID 3328 wrote to memory of 4840	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	319
PID 3328 wrote to memory of 4740	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	320
PID 3328 wrote to memory of 2128	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	323
PID 3328 wrote to memory of 916	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	325
PID 3328 wrote to memory of 5668	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	205
PID 3328 wrote to memory of 3416	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	207
PID 3328 wrote to memory of 1784	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	330
PID 3328 wrote to memory of 6088	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	211
PID 3328 wrote to memory of 4492	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	213
PID 3328 wrote to memory of 4108	3328	2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	215

C:\Users\Admin\AppData\Local\Temp\2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_f7176aa0ddaad5624c5fe5d5a00000d3_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4492
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1580
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4956
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1656
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2560
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5868
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3048
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2088
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4204
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4564
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2396
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5656
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3416
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6088
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4492
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4340
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2396
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1352
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4772
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2980
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5524
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1452
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:972
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6076
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4312
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3232
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3908
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6024
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5872
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4840
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4740
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5288
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1784
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3176
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4312
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1780
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5048
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2012
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4388
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5008
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1528
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1296
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1652
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4632
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5496
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3624
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4108
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4672
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1316
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3144
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3420
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1816
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2424
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:248
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4456
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6048
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2612
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5868
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3356
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3212
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5548
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3948
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6004
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3276
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5760
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2592
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5680
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1116
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5428
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4332
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5632
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4356
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1280
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1404
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4284
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3868
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3132
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2820
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5128
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4472
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2584
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1428
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5496
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1776
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4996
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5764
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3312
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3808
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1800
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3184
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6004
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4792
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5072
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5040
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1060
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2924
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6048
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5348
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5224
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:576
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5868
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6096
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2892
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1252
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3440
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4572
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1504
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1148
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3152
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6056
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5880
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1136
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3344
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1304
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4196
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1364
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5240
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5200
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2732
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4124
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6100
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5016
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5680
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5668
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4752
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5032
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5804
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3212
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2944
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5516
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2704
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1104
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5808
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2168
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3324
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5932
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4656
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1692
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4844
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4896
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4756
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4748
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5832
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4824
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5376
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1360
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:616
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:712
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5968
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2228
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1508
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3164
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1848
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4708
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2588
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5940
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2144
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5640
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1316
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5888
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6112
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4140
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1532
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3004
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5384
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2412
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:468
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:6080
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3484
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5964
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2568
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5732
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3700
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2208
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5252
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:620
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1348
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4600
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1252
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1432
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3320
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4312
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5064
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2744
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1104
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3480
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4180
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1020
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1788
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5488
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2000
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5272
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3052
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1996
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3160
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:464
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:912
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5688
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2852
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2796
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5216
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1492
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5736
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1920
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5328
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2572
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3664
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2788
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1428
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:836
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5976
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2696
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4660
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1460
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4268
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5380
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5648
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5988
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4436
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3596
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2644
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3044
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4716
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:3068
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1724
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2172
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4684
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2720
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5084
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2260
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2092
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:1604
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2400
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2856
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4916
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:4472
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5336
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2960
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:2120
- C:\Windows\system32\whoami.exe
  whoami /groups
  2⤵
  PID:5644

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads