ecdb8522f592a4f229825ea2a33739f1be111802c63e200cc7aedbf5e16c0c77

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 14.6MB
Sample261029-zf69mscd65
SHA256 ecdb8522f592a4f229825ea2a33739f1be111802c63e200cc7aedbf5e16c0c77
MD5 b32f12783e11d38a23190580a1938ff4
SHA1 fa17e6e314e9b4d52a4ae9973133f2b48b5c8c87
SHA512 e42acc19dcd239cb203196111bdeb3987f98a8f3e0e163d5fd7e867540b7607ef3c8a55443881cc5cefe912bde174a35fbad959beb3d440f7b8f466eaaf853b5
SSDEEP 393216:O3CuyW8ZK8MOuC0XoWAq4t0hPiBtYWYXg:bW8zMzCAM0hPiTYWU
TLSH
T158F633AC376600EAFCD5E338A9C2C4764AD57E620B95C5934AF01E920AB31D5FE76313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 26 IoCs

pid	Process
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
996	cscript.exe
4628	cscript.exe
1048	cscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3788	powershell.exe
2248	powershell.exe
3108	powershell.exe
4064	powershell.exe
3924	powershell.exe
1364	powershell.exe
4196	powershell.exe
4284	powershell.exe
1880	powershell.exe
3296	powershell.exe
2268	powershell.exe
1780	powershell.exe
4652	powershell.exe
4160	powershell.exe
4000	powershell.exe
4132	powershell.exe
4848	powershell.exe
60	powershell.exe
4180	powershell.exe
2784	powershell.exe
2052	powershell.exe
4536	powershell.exe
3232	powershell.exe
4436	powershell.exe
4888	powershell.exe
2824	powershell.exe
4352	powershell.exe
5108	powershell.exe
2364	powershell.exe
4196	powershell.exe
4480	powershell.exe
1100	powershell.exe
4984	powershell.exe
1884	powershell.exe
2664	powershell.exe
1152	powershell.exe
2704	powershell.exe
4684	powershell.exe
4992	powershell.exe
1848	powershell.exe
3144	powershell.exe
1008	powershell.exe
3244	powershell.exe
2296	powershell.exe
176	powershell.exe
2096	powershell.exe
2492	powershell.exe
2708	powershell.exe
4136	powershell.exe
2896	powershell.exe
4396	powershell.exe
4108	powershell.exe
3064	powershell.exe
3228	powershell.exe
1992	powershell.exe
2740	powershell.exe
4684	powershell.exe
972	powershell.exe
2036	powershell.exe
5096	powershell.exe
4012	powershell.exe
4536	powershell.exe
2852	powershell.exe
4632	powershell.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
4076	cmd.exe
3656	cmd.exe
4888	cmd.exe
1220	cmd.exe
3232	cmd.exe
2508	cmd.exe
1368	cmd.exe
4528	cmd.exe
3804	cmd.exe
1892	cmd.exe
808	cmd.exe
5048	cmd.exe
4808	cmd.exe
3176	cmd.exe
2524	cmd.exe
1596	cmd.exe
4732	cmd.exe
4764	cmd.exe
5056	cmd.exe
2896	cmd.exe
996	cmd.exe
1780	cmd.exe
1200	cmd.exe
5108	cmd.exe
4064	cmd.exe
4812	cmd.exe
1600	cmd.exe
3328	cmd.exe
3112	cmd.exe
2704	cmd.exe
536	cmd.exe
3448	cmd.exe
2608	cmd.exe
4512	cmd.exe
1804	cmd.exe
4768	cmd.exe
1772	cmd.exe
1028	cmd.exe
1656	cmd.exe
4708	cmd.exe
2644	cmd.exe
5080	cmd.exe
1808	cmd.exe
4052	cmd.exe
3784	cmd.exe
2868	cmd.exe
4032	cmd.exe
1816	cmd.exe
2244	cmd.exe
4308	cmd.exe
4984	cmd.exe
704	cmd.exe
2452	cmd.exe
1740	cmd.exe
3100	cmd.exe
3748	cmd.exe
2012	cmd.exe
3608	cmd.exe
736	cmd.exe
4628	cmd.exe
4752	cmd.exe
4472	cmd.exe
2396	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3108	powershell.exe
3108	powershell.exe
2984	powershell.exe
2984	powershell.exe
1100	powershell.exe
1100	powershell.exe
4984	powershell.exe
4984	powershell.exe
2644	powershell.exe
2644	powershell.exe
4000	powershell.exe
4000	powershell.exe
4772	powershell.exe
4772	powershell.exe
1780	powershell.exe
1780	powershell.exe
4036	powershell.exe
4036	powershell.exe
3232	powershell.exe
3232	powershell.exe
2012	powershell.exe
2012	powershell.exe
4436	powershell.exe
4436	powershell.exe
4352	powershell.exe
4352	powershell.exe
3032	powershell.exe
3032	powershell.exe
2620	powershell.exe
2620	powershell.exe
4512	powershell.exe
4512	powershell.exe
1788	powershell.exe
1788	powershell.exe
3064	powershell.exe
3064	powershell.exe
3864	powershell.exe
3864	powershell.exe
4064	powershell.exe
4064	powershell.exe
3896	powershell.exe
3896	powershell.exe
5036	powershell.exe
5036	powershell.exe
928	powershell.exe
928	powershell.exe
2300	powershell.exe
2300	powershell.exe
3788	powershell.exe
3788	powershell.exe
3268	powershell.exe
3268	powershell.exe
4452	powershell.exe
4452	powershell.exe
3144	powershell.exe
3144	powershell.exe
2740	powershell.exe
2740	powershell.exe
4776	powershell.exe
4776	powershell.exe
4396	powershell.exe
4396	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	3788	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	5044	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3332	4800	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	83
PID 3332 wrote to memory of 2868	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 2868 wrote to memory of 3108	2868	cmd.exe	90
PID 3332 wrote to memory of 2552	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2552 wrote to memory of 2984	2552	cmd.exe	93
PID 3332 wrote to memory of 996	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	94
PID 3332 wrote to memory of 4628	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 3332 wrote to memory of 1048	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 3332 wrote to memory of 2524	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	102
PID 2524 wrote to memory of 1100	2524	cmd.exe	104
PID 3332 wrote to memory of 1864	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 1864 wrote to memory of 4984	1864	cmd.exe	107
PID 3332 wrote to memory of 4424	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	108
PID 4424 wrote to memory of 2644	4424	cmd.exe	110
PID 3332 wrote to memory of 2916	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	111
PID 2916 wrote to memory of 2896	2916	cmd.exe	113
PID 3332 wrote to memory of 3708	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	115
PID 3708 wrote to memory of 4000	3708	cmd.exe	117
PID 3332 wrote to memory of 2804	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	118
PID 2804 wrote to memory of 4772	2804	cmd.exe	120
PID 3332 wrote to memory of 1236	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	121
PID 1236 wrote to memory of 1780	1236	cmd.exe	123
PID 3332 wrote to memory of 2828	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	124
PID 2828 wrote to memory of 4036	2828	cmd.exe	126
PID 3332 wrote to memory of 996	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	127
PID 996 wrote to memory of 3232	996	cmd.exe	129
PID 3332 wrote to memory of 888	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	130
PID 888 wrote to memory of 2012	888	cmd.exe	132
PID 3332 wrote to memory of 1596	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 1596 wrote to memory of 4436	1596	cmd.exe	135
PID 3332 wrote to memory of 3532	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	136
PID 3532 wrote to memory of 4352	3532	cmd.exe	138
PID 3332 wrote to memory of 2180	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	139
PID 2180 wrote to memory of 3032	2180	cmd.exe	141
PID 3332 wrote to memory of 1844	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	142
PID 1844 wrote to memory of 2620	1844	cmd.exe	144
PID 3332 wrote to memory of 1740	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 1740 wrote to memory of 4512	1740	cmd.exe	147
PID 3332 wrote to memory of 3528	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	148
PID 3528 wrote to memory of 1788	3528	cmd.exe	150
PID 3332 wrote to memory of 3540	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	151
PID 3540 wrote to memory of 3064	3540	cmd.exe	153
PID 3332 wrote to memory of 3008	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	154
PID 3008 wrote to memory of 3864	3008	cmd.exe	156
PID 3332 wrote to memory of 4768	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	157
PID 4768 wrote to memory of 4064	4768	cmd.exe	159
PID 3332 wrote to memory of 4984	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	160
PID 4984 wrote to memory of 3896	4984	cmd.exe	162
PID 3332 wrote to memory of 2644	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 2644 wrote to memory of 5036	2644	cmd.exe	165
PID 3332 wrote to memory of 4304	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	166
PID 4304 wrote to memory of 928	4304	cmd.exe	168
PID 3332 wrote to memory of 1276	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	169
PID 1276 wrote to memory of 2300	1276	cmd.exe	171
PID 3332 wrote to memory of 3272	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	172
PID 3272 wrote to memory of 3788	3272	cmd.exe	174
PID 3332 wrote to memory of 3132	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	175
PID 3132 wrote to memory of 3268	3132	cmd.exe	177
PID 3332 wrote to memory of 5048	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	179
PID 5048 wrote to memory of 4452	5048	cmd.exe	181
PID 3332 wrote to memory of 4032	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	182
PID 4032 wrote to memory of 3144	4032	cmd.exe	184
PID 3332 wrote to memory of 2184	3332	2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	185
PID 2184 wrote to memory of 2740	2184	cmd.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_b32f12783e11d38a23190580a1938ff4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\Windows\SYSTEM32\cscript.exe
    cscript //NoLogo C:\Windows\System32\slmgr.vbs /xpr
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:996
- - C:\Windows\SYSTEM32\cscript.exe
    cscript //NoLogo C:\Windows\System32\slmgr.vbs /dlv
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:4628
- - C:\Windows\SYSTEM32\cscript.exe
    cscript //NoLogo C:\Windows\System32\slmgr.vbs /dli
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:5080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:5044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:3784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:2244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:1804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:60
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:2036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    - Executes a command shell one-liner
    PID:808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'ProAdminLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation""
    3⤵
    PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-WebBinding -Name 'SurpassLocal' | Select-Object -ExpandProperty bindingInformation"
      4⤵
      PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact