text:    In addition to the backdoor’s modus operandi, the attackers will use a Microsoft WMI command-line tool to list the compromised system’s running processes, which are sent to the C&C server:  “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr SysWOW” “C:\Windows\system32\cmd.exe” /c “wmic process get processid,commandline,sessionid | findstr x86”    Technical Analysis