1787330477a:5:{s:6:"status";b:1;s:4:"data";a:10:{i:0;a:2:{i:0;s:66:"c:\program files\cymulate\agent\service\cymulate.agent.service.exe";i:1;s:4:"7312";}i:1;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.778\cymulate.agent.executor.exe";i:1;s:4:"3529";}i:2;a:2:{i:0;s:32:"c:\windows\system32\schtasks.exe";i:1;s:2:"84";}i:3;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.828\cymulate.agent.executor.exe";i:1;s:2:"45";}i:4;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.785\cymulate.agent.executor.exe";i:1;s:2:"42";}i:5;a:2:{i:0;s:12:"/usr/bin/cat";i:1;s:2:"19";}i:6;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.796\cymulate.agent.executor.exe";i:1;s:1:"7";}i:7;a:2:{i:0;s:76:"c:\program files\cymulate\agent\executor\650.789\cymulate.agent.executor.exe";i:1;s:1:"6";}i:8;a:2:{i:0;s:30:"c:\windows\system32\pktmon.exe";i:1;s:1:"3";}i:9;a:2:{i:0;s:150:"C:\Program Files\Cymulate\EDR_Attacks\6a641faa85242ca9468c6999\3c48e17869f5527838ad4946eaf5aa5d_DLLINJECT_nativeransomwareremotekeyOurAESoverwrite.exe";i:1;s:1:"2";}}s:11:"data_labels";a:2:{i:0;s:9:"File Path";i:1;s:5:"count";}s:6:"search";s:224:"search ```Events by File Path - User Defined id:140``` index="mss-edr_1f568f8d3c2b42d387f927cf435ecd4d" sourcetype="cynet:alerts" | dedup _time, Path | stats count by Path | sort -count | head 10 | rename Path as "File Path"";s:16:"cache_expiration";i:300;}