The "ownerless" connections [this command was run as root/admin] The exploit is using E2C to hide its network traffic. Most exploits are easily identifiable to anyone who builds a machine like this [bare bones, stripped down, scripts installed to bludgeon MS updates and connections, limited 3rd party software with all possible connections identified & modeled] You simply look for network traffic that doesn't fit your models, then you look at what they are attached to. In this case, they were not attached to what they were supposed to be attached to [Bethesda tools]