ee66b8026a7e26770b1e10ed9f125a6828e5c76f5ea1b9f113d4ea963a78b609

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GHXSTLY Tweaks.exe
Size 180.0MB
Sample261024-wfzb9awsd1
SHA256 ee66b8026a7e26770b1e10ed9f125a6828e5c76f5ea1b9f113d4ea963a78b609
MD5 15a34827a8d9b32e3a618e8b219d0306
SHA1 c913b76035dff4b748fe994034f9304c73d9cc72
SHA512 e32d1c2e9777545237b59e1524db9ee0da254d86dfb160f8daf4b44fa62a379307f058894f583819620f9067fac237f8d7ffb2d3c952ecf8c24e04d192723a95
SSDEEP 1572864:hH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:msok+hK7
TLSH
T1B5988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe
4480	powershell.exe
4400	powershell.exe
3812	powershell.exe
4808	powershell.exe
3888	powershell.exe
724	powershell.exe
4748	powershell.exe
568	powershell.exe
1972	powershell.exe
1256	powershell.exe
3856	powershell.exe
872	powershell.exe
3892	powershell.exe
2556	powershell.exe
1552	powershell.exe
4736	powershell.exe
2064	powershell.exe
568	powershell.exe
5084	powershell.exe
3900	powershell.exe
3464	powershell.exe
3020	powershell.exe
1544	powershell.exe
3064	powershell.exe
3060	powershell.exe
440	powershell.exe
4356	powershell.exe
3860	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	GHXSTLY Tweaks.exe

Discovers running processes 1 TTPs 10 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2080	tasklist.exe
372	tasklist.exe
1612	tasklist.exe
1040	tasklist.exe
3060	tasklist.exe
4576	tasklist.exe
2968	tasklist.exe
2908	tasklist.exe
4136	tasklist.exe
764	tasklist.exe

Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4108	reg.exe

Executes a command shell one-liner 1 TTPs 41 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe
3808	cmd.exe
3052	cmd.exe
4348	cmd.exe
2480	cmd.exe
5064	cmd.exe
2556	cmd.exe
2856	cmd.exe
2844	cmd.exe
1844	cmd.exe
1788	cmd.exe
3232	cmd.exe
4224	cmd.exe
3408	cmd.exe
212	cmd.exe
4952	cmd.exe
456	cmd.exe
2960	cmd.exe
960	cmd.exe
4964	cmd.exe
2152	cmd.exe
5000	cmd.exe
2384	cmd.exe
4264	cmd.exe
2704	cmd.exe
3696	cmd.exe
5036	cmd.exe
1780	cmd.exe
1612	cmd.exe
400	cmd.exe
4304	cmd.exe
1724	cmd.exe
2220	cmd.exe
4536	cmd.exe
2436	cmd.exe
2876	cmd.exe
1620	cmd.exe
992	cmd.exe
3732	cmd.exe
3528	cmd.exe
3772	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GHXSTLY Tweaks.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GHXSTLY Tweaks.exe

System Time Discovery 1 TTPs 10 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	cmd.exe
4116	cmd.exe
4304	cmd.exe
2856	cmd.exe
2220	cmd.exe
2960	cmd.exe
2876	cmd.exe
960	cmd.exe
3732	cmd.exe
2152	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
3860	powershell.exe
3860	powershell.exe
3860	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
568	powershell.exe
568	powershell.exe
1256	powershell.exe
1256	powershell.exe
5084	powershell.exe
5084	powershell.exe
3900	powershell.exe
3900	powershell.exe
724	powershell.exe
724	powershell.exe
4748	powershell.exe
4748	powershell.exe
3060	powershell.exe
3060	powershell.exe
1552	powershell.exe
1552	powershell.exe
3464	powershell.exe
3464	powershell.exe
2084	GHXSTLY Tweaks.exe
2084	GHXSTLY Tweaks.exe
3856	powershell.exe
3856	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	764	tasklist.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeShutdownPrivilege	4292	GHXSTLY Tweaks.exe
Token: SeCreatePagefilePrivilege	4292	GHXSTLY Tweaks.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4896	4292	GHXSTLY Tweaks.exe	84
PID 4292 wrote to memory of 4896	4292	GHXSTLY Tweaks.exe	84
PID 4292 wrote to memory of 2076	4292	GHXSTLY Tweaks.exe	85
PID 4292 wrote to memory of 1344	4292	GHXSTLY Tweaks.exe	89
PID 4292 wrote to memory of 1344	4292	GHXSTLY Tweaks.exe	89
PID 4292 wrote to memory of 1620	4292	GHXSTLY Tweaks.exe	90
PID 1620 wrote to memory of 4108	1620	cmd.exe	92
PID 4292 wrote to memory of 5000	4292	GHXSTLY Tweaks.exe	93
PID 5000 wrote to memory of 1728	5000	cmd.exe	95
PID 1728 wrote to memory of 3936	1728	net.exe	96
PID 4292 wrote to memory of 3232	4292	GHXSTLY Tweaks.exe	98
PID 4292 wrote to memory of 1788	4292	GHXSTLY Tweaks.exe	99
PID 3232 wrote to memory of 764	3232	cmd.exe	102
PID 1788 wrote to memory of 3020	1788	cmd.exe	103
PID 4292 wrote to memory of 3052	4292	GHXSTLY Tweaks.exe	105
PID 3052 wrote to memory of 3860	3052	cmd.exe	108
PID 4292 wrote to memory of 4348	4292	GHXSTLY Tweaks.exe	111
PID 4348 wrote to memory of 872	4348	cmd.exe	113
PID 4292 wrote to memory of 2384	4292	GHXSTLY Tweaks.exe	114
PID 2384 wrote to memory of 2080	2384	cmd.exe	116
PID 4292 wrote to memory of 992	4292	GHXSTLY Tweaks.exe	117
PID 992 wrote to memory of 1544	992	cmd.exe	119
PID 4292 wrote to memory of 3732	4292	GHXSTLY Tweaks.exe	120
PID 3732 wrote to memory of 3476	3732	cmd.exe	122
PID 4292 wrote to memory of 3528	4292	GHXSTLY Tweaks.exe	125
PID 3528 wrote to memory of 3064	3528	cmd.exe	127
PID 4292 wrote to memory of 400	4292	GHXSTLY Tweaks.exe	128
PID 400 wrote to memory of 1040	400	cmd.exe	130
PID 4292 wrote to memory of 3772	4292	GHXSTLY Tweaks.exe	131
PID 3772 wrote to memory of 4480	3772	cmd.exe	133
PID 4292 wrote to memory of 4116	4292	GHXSTLY Tweaks.exe	134
PID 4116 wrote to memory of 2556	4116	cmd.exe	136
PID 4292 wrote to memory of 2480	4292	GHXSTLY Tweaks.exe	137
PID 2480 wrote to memory of 4400	2480	cmd.exe	139
PID 4292 wrote to memory of 3808	4292	GHXSTLY Tweaks.exe	140
PID 3808 wrote to memory of 372	3808	cmd.exe	142
PID 4292 wrote to memory of 4264	4292	GHXSTLY Tweaks.exe	143
PID 4264 wrote to memory of 568	4264	cmd.exe	145
PID 4292 wrote to memory of 4304	4292	GHXSTLY Tweaks.exe	146
PID 4304 wrote to memory of 1972	4304	cmd.exe	148
PID 4292 wrote to memory of 212	4292	GHXSTLY Tweaks.exe	149
PID 212 wrote to memory of 3892	212	cmd.exe	151
PID 4292 wrote to memory of 4952	4292	GHXSTLY Tweaks.exe	152
PID 4952 wrote to memory of 1612	4952	cmd.exe	154
PID 4292 wrote to memory of 2556	4292	GHXSTLY Tweaks.exe	155
PID 2556 wrote to memory of 3812	2556	cmd.exe	157
PID 4292 wrote to memory of 2856	4292	GHXSTLY Tweaks.exe	158
PID 2856 wrote to memory of 3888	2856	cmd.exe	160
PID 4292 wrote to memory of 2704	4292	GHXSTLY Tweaks.exe	161
PID 2704 wrote to memory of 568	2704	cmd.exe	163
PID 4292 wrote to memory of 3696	4292	GHXSTLY Tweaks.exe	164
PID 3696 wrote to memory of 3060	3696	cmd.exe	166
PID 4292 wrote to memory of 1724	4292	GHXSTLY Tweaks.exe	167
PID 1724 wrote to memory of 1256	1724	cmd.exe	169
PID 4292 wrote to memory of 2220	4292	GHXSTLY Tweaks.exe	170
PID 2220 wrote to memory of 5084	2220	cmd.exe	172
PID 4292 wrote to memory of 5064	4292	GHXSTLY Tweaks.exe	173
PID 5064 wrote to memory of 3900	5064	cmd.exe	175
PID 4292 wrote to memory of 456	4292	GHXSTLY Tweaks.exe	176
PID 456 wrote to memory of 4576	456	cmd.exe	178
PID 4292 wrote to memory of 4536	4292	GHXSTLY Tweaks.exe	179
PID 4536 wrote to memory of 724	4536	cmd.exe	181
PID 4292 wrote to memory of 2960	4292	GHXSTLY Tweaks.exe	182
PID 2960 wrote to memory of 4748	2960	cmd.exe	184

C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe
"C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1764,i,13558103762912958999,12065341380939191581,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:4896
- C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --field-trial-handle=2112,i,13558103762912958999,12065341380939191581,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2076
- C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3136,i,13558103762912958999,12065341380939191581,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    - Queries registry keys for unique system GUIDs
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  PID:4224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3464
- C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\GHXSTLY Tweaks.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ghxstly-tweaks" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3544,i,13558103762912958999,12065341380939191581,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  PID:1780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:2844
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "Test-Connection -ComputerName '1.1.1.1' -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:1844
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue""
  2⤵
  - Executes a command shell one-liner
  PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "(Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 1 -MaxSamples 2 | Select-Object -ExpandProperty CounterSamples | Select-Object -Last 1).CookedValue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average""
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:2152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -NoProfile -Command "$gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1).NextHop; Test-Connection -ComputerName $gw -Count 2 | Measure-Object -Property ResponseTime -Average | Select-Object -ExpandProperty Average"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...