admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to obtain information about services:

admin@338 actors used the following commands following exploitation of a machine with

LOWBALL malware to enumerate user accounts:

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to list local groups:

LOWBALL malware,

admin@338 actors created a file containing a list of commands to be executed on the compromised computer.(Citation: FireEye admin@338)|