6f6ee4710884d7b9a6fe498ffe66d0833ccdaddc2a99dff529a42fce2ed32d50

Analysis

max time kernel
150s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Merluis.exe
Size 200.4MB
Sample260407-s8dpgahs5l
SHA256 6f6ee4710884d7b9a6fe498ffe66d0833ccdaddc2a99dff529a42fce2ed32d50
MD5 39055af3485c58631341edae17938ad2
SHA1 a39d652c686c6a0ba4b27533676c5ae68ed19e8a
SHA512 8ff4b3b885b713d82ead543adfc409b6ae2dbcaf935317edaf8c45bc71a03089c1b012ea6cc940a049a7865a30e27bb2c8c0d732dce6ad1df653b1b28c39d46a
SSDEEP 1572864:FqaVl3T8N+NCd7+PthILD+LM7ug9a/QqTxcqJf1WWJbYUZZv4I9ihgLrAwqi9mLy:MaVlD8Np7+VsITcrMJLg
TLSH
T1A9A88C03E29641D9E05DD175974A9633FE72B8094B28A3DF2B5407922FB7EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation	Merluis.exe

Executes dropped EXE 2 IoCs

pid	Process
3964	javaw.exe
4824	javaw.exe

Loads dropped DLL 21 IoCs

pid	Process
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
4824	javaw.exe
4824	javaw.exe
4824	javaw.exe
4824	javaw.exe
4824	javaw.exe
4824	javaw.exe
4824	javaw.exe
3964	javaw.exe
3964	javaw.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	discord.com
48	discord.com
49	discord.com
15	discord.com
21	discord.com
35	discord.com
47	discord.com
50	discord.com
12	discord.com
13	discord.com
14	discord.com
34	discord.com
38	discord.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
408	tasklist.exe
3788	tasklist.exe
4356	tasklist.exe
4432	tasklist.exe
5312	tasklist.exe
4176	tasklist.exe
5744	tasklist.exe
5836	tasklist.exe
3676	tasklist.exe
3756	tasklist.exe
4504	tasklist.exe
5300	tasklist.exe
5796	tasklist.exe
1140	tasklist.exe
4564	tasklist.exe
5664	tasklist.exe
1196	tasklist.exe
4420	tasklist.exe
2988	tasklist.exe
4268	tasklist.exe
5504	tasklist.exe
1068	tasklist.exe
5248	tasklist.exe
5200	tasklist.exe
3228	tasklist.exe
6040	tasklist.exe
4712	tasklist.exe
1532	tasklist.exe
3136	tasklist.exe
5808	tasklist.exe
5160	tasklist.exe
5512	tasklist.exe
3976	tasklist.exe
2184	tasklist.exe
4116	tasklist.exe
3100	tasklist.exe
2284	tasklist.exe
4152	tasklist.exe
4028	tasklist.exe
4448	tasklist.exe
1604	tasklist.exe
2524	tasklist.exe
5448	tasklist.exe
2688	tasklist.exe
3564	tasklist.exe
5528	tasklist.exe
2720	tasklist.exe
4768	tasklist.exe
5092	tasklist.exe
5704	tasklist.exe
2432	tasklist.exe
5268	tasklist.exe
4324	tasklist.exe
4476	tasklist.exe
5604	tasklist.exe
1472	tasklist.exe
5352	tasklist.exe
5932	tasklist.exe
4916	tasklist.exe
5108	tasklist.exe
5172	tasklist.exe
4520	tasklist.exe
5052	tasklist.exe
2960	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 46 IoCs

defense_evasion

pid	Process
2924	taskkill.exe
2468	taskkill.exe
4940	taskkill.exe
3384	taskkill.exe
4132	taskkill.exe
4572	taskkill.exe
2888	taskkill.exe
4432	taskkill.exe
3248	taskkill.exe
3008	taskkill.exe
4364	taskkill.exe
3012	taskkill.exe
1972	taskkill.exe
3296	taskkill.exe
1484	taskkill.exe
3500	taskkill.exe
4072	taskkill.exe
4684	taskkill.exe
2164	taskkill.exe
3260	taskkill.exe
2752	taskkill.exe
1000	taskkill.exe
4616	taskkill.exe
4284	taskkill.exe
2216	taskkill.exe
3108	taskkill.exe
2596	taskkill.exe
2844	taskkill.exe
3360	taskkill.exe
3284	taskkill.exe
2836	taskkill.exe
3628	taskkill.exe
4128	taskkill.exe
3812	taskkill.exe
3752	taskkill.exe
1732	taskkill.exe
4568	taskkill.exe
4524	taskkill.exe
3928	taskkill.exe
4868	taskkill.exe
2916	taskkill.exe
3508	taskkill.exe
4000	taskkill.exe
2852	taskkill.exe
4704	taskkill.exe
3100	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe
224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe
3964	javaw.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4784	WMIC.exe
Token: SeSecurityPrivilege	4784	WMIC.exe
Token: SeTakeOwnershipPrivilege	4784	WMIC.exe
Token: SeLoadDriverPrivilege	4784	WMIC.exe
Token: SeSystemProfilePrivilege	4784	WMIC.exe
Token: SeSystemtimePrivilege	4784	WMIC.exe
Token: SeProfSingleProcessPrivilege	4784	WMIC.exe
Token: SeIncBasePriorityPrivilege	4784	WMIC.exe
Token: SeCreatePagefilePrivilege	4784	WMIC.exe
Token: SeBackupPrivilege	4784	WMIC.exe
Token: SeRestorePrivilege	4784	WMIC.exe
Token: SeShutdownPrivilege	4784	WMIC.exe
Token: SeDebugPrivilege	4784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4784	WMIC.exe
Token: SeRemoteShutdownPrivilege	4784	WMIC.exe
Token: SeUndockPrivilege	4784	WMIC.exe
Token: SeManageVolumePrivilege	4784	WMIC.exe
Token: 33	4784	WMIC.exe
Token: 34	4784	WMIC.exe
Token: 35	4784	WMIC.exe
Token: 36	4784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4784	WMIC.exe
Token: SeSecurityPrivilege	4784	WMIC.exe
Token: SeTakeOwnershipPrivilege	4784	WMIC.exe
Token: SeLoadDriverPrivilege	4784	WMIC.exe
Token: SeSystemProfilePrivilege	4784	WMIC.exe
Token: SeSystemtimePrivilege	4784	WMIC.exe
Token: SeProfSingleProcessPrivilege	4784	WMIC.exe
Token: SeIncBasePriorityPrivilege	4784	WMIC.exe
Token: SeCreatePagefilePrivilege	4784	WMIC.exe
Token: SeBackupPrivilege	4784	WMIC.exe
Token: SeRestorePrivilege	4784	WMIC.exe
Token: SeShutdownPrivilege	4784	WMIC.exe
Token: SeDebugPrivilege	4784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4784	WMIC.exe
Token: SeRemoteShutdownPrivilege	4784	WMIC.exe
Token: SeUndockPrivilege	4784	WMIC.exe
Token: SeManageVolumePrivilege	4784	WMIC.exe
Token: 33	4784	WMIC.exe
Token: 34	4784	WMIC.exe
Token: 35	4784	WMIC.exe
Token: 36	4784	WMIC.exe
Token: SeDebugPrivilege	2336	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3928	WMIC.exe
Token: SeSecurityPrivilege	3928	WMIC.exe
Token: SeTakeOwnershipPrivilege	3928	WMIC.exe
Token: SeLoadDriverPrivilege	3928	WMIC.exe
Token: SeSystemProfilePrivilege	3928	WMIC.exe
Token: SeSystemtimePrivilege	3928	WMIC.exe
Token: SeProfSingleProcessPrivilege	3928	WMIC.exe
Token: SeIncBasePriorityPrivilege	3928	WMIC.exe
Token: SeCreatePagefilePrivilege	3928	WMIC.exe
Token: SeBackupPrivilege	3928	WMIC.exe
Token: SeRestorePrivilege	3928	WMIC.exe
Token: SeShutdownPrivilege	3928	WMIC.exe
Token: SeDebugPrivilege	3928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3928	WMIC.exe
Token: SeRemoteShutdownPrivilege	3928	WMIC.exe
Token: SeUndockPrivilege	3928	WMIC.exe
Token: SeManageVolumePrivilege	3928	WMIC.exe
Token: 33	3928	WMIC.exe
Token: 34	3928	WMIC.exe
Token: 35	3928	WMIC.exe
Token: 36	3928	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3964	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 3964	1108	Merluis.exe	83
PID 3964 wrote to memory of 4784	3964	javaw.exe	87
PID 3964 wrote to memory of 224	3964	javaw.exe	89
PID 3964 wrote to memory of 4140	3964	javaw.exe	91
PID 3964 wrote to memory of 2336	3964	javaw.exe	96
PID 3964 wrote to memory of 3928	3964	javaw.exe	100
PID 3964 wrote to memory of 4204	3964	javaw.exe	102
PID 3964 wrote to memory of 5036	3964	javaw.exe	104
PID 3964 wrote to memory of 4136	3964	javaw.exe	106
PID 3964 wrote to memory of 3792	3964	javaw.exe	108
PID 3964 wrote to memory of 2284	3964	javaw.exe	110
PID 3964 wrote to memory of 5080	3964	javaw.exe	112
PID 3964 wrote to memory of 220	3964	javaw.exe	114
PID 3964 wrote to memory of 4576	3964	javaw.exe	118
PID 3964 wrote to memory of 3576	3964	javaw.exe	120
PID 3964 wrote to memory of 2672	3964	javaw.exe	122
PID 3964 wrote to memory of 4420	3964	javaw.exe	124
PID 3964 wrote to memory of 5112	3964	javaw.exe	126
PID 3964 wrote to memory of 4520	3964	javaw.exe	128
PID 3964 wrote to memory of 3248	3964	javaw.exe	130
PID 3964 wrote to memory of 2468	3964	javaw.exe	132
PID 3964 wrote to memory of 3436	3964	javaw.exe	137
PID 3964 wrote to memory of 3292	3964	javaw.exe	139
PID 3964 wrote to memory of 4940	3964	javaw.exe	141
PID 3964 wrote to memory of 1000	3964	javaw.exe	143
PID 3964 wrote to memory of 3008	3964	javaw.exe	145
PID 3964 wrote to memory of 3384	3964	javaw.exe	147
PID 3964 wrote to memory of 3188	3964	javaw.exe	149
PID 3964 wrote to memory of 4152	3964	javaw.exe	151
PID 3964 wrote to memory of 1676	3964	javaw.exe	153
PID 3964 wrote to memory of 1472	3964	javaw.exe	155
PID 3964 wrote to memory of 4128	3964	javaw.exe	157
PID 3964 wrote to memory of 3360	3964	javaw.exe	159
PID 3964 wrote to memory of 3768	3964	javaw.exe	161
PID 3964 wrote to memory of 1756	3964	javaw.exe	163
PID 3964 wrote to memory of 3284	3964	javaw.exe	165
PID 3964 wrote to memory of 4000	3964	javaw.exe	167
PID 3964 wrote to memory of 4932	3964	javaw.exe	169
PID 3964 wrote to memory of 224	3964	javaw.exe	171
PID 3964 wrote to memory of 4364	3964	javaw.exe	173
PID 3964 wrote to memory of 3752	3964	javaw.exe	174
PID 3964 wrote to memory of 4616	3964	javaw.exe	175
PID 3964 wrote to memory of 3812	3964	javaw.exe	177
PID 3964 wrote to memory of 3500	3964	javaw.exe	178
PID 3964 wrote to memory of 4072	3964	javaw.exe	179
PID 3964 wrote to memory of 2852	3964	javaw.exe	180
PID 3964 wrote to memory of 2836	3964	javaw.exe	181
PID 3964 wrote to memory of 4132	3964	javaw.exe	182
PID 3964 wrote to memory of 4572	3964	javaw.exe	183
PID 3964 wrote to memory of 2844	3964	javaw.exe	184
PID 3964 wrote to memory of 3928	3964	javaw.exe	185
PID 3964 wrote to memory of 4868	3964	javaw.exe	186
PID 3964 wrote to memory of 4284	3964	javaw.exe	187
PID 3964 wrote to memory of 2216	3964	javaw.exe	188
PID 3964 wrote to memory of 2924	3964	javaw.exe	189
PID 3964 wrote to memory of 1732	3964	javaw.exe	190
PID 3964 wrote to memory of 4568	3964	javaw.exe	191
PID 3964 wrote to memory of 4704	3964	javaw.exe	192
PID 3964 wrote to memory of 4684	3964	javaw.exe	193
PID 3964 wrote to memory of 3628	3964	javaw.exe	194
PID 3964 wrote to memory of 2164	3964	javaw.exe	195
PID 3964 wrote to memory of 2888	3964	javaw.exe	196
PID 3964 wrote to memory of 2916	3964	javaw.exe	197
PID 3964 wrote to memory of 4432	3964	javaw.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Merluis.exe
"C:\Users\Admin\AppData\Local\Temp\Merluis.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe -jar C:\Users\Admin\AppData\Local\update.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:224
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4204
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5036
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4136
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3792
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2284
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5080
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:220
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4576
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3576
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2672
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4420
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5112
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:3248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2468
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3436
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3292
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4940
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:1000
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM zen.exe /T
    3⤵
    - Kills process with taskkill
    PID:3008
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:3384
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3188
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4152
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1676
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4128
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:3360
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3768
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    PID:3284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM "ůŰeRa eØe" /T
    3⤵
    - Kills process with taskkill
    PID:4000
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4932
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:224
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4364
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:3752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Ŧũrefox.exe
    3⤵
    - Kills process with taskkill
    PID:3812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM oŰera.exe
    3⤵
    - Kills process with taskkill
    PID:3500
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:4072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM ůŲBIPQÍ.exe
    3⤵
    - Kills process with taskkill
    PID:2852
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:2836
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:4132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:4572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:2844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:3928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:4868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    PID:4284
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:2216
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM šŭiGo.exe
    3⤵
    - Kills process with taskkill
    PID:2924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Ŵorch.exe
    3⤵
    - Kills process with taskkill
    PID:1732
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM ŷaterfox.exe
    3⤵
    - Kills process with taskkill
    PID:4568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM palemoon.exe
    3⤵
    - Kills process with taskkill
    PID:4704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM librewolf.exe
    3⤵
    - Kills process with taskkill
    PID:4684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Ŵůr.exe
    3⤵
    - Kills process with taskkill
    PID:3628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM chromium.exe
    3⤵
    - Kills process with taskkill
    PID:2164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM maxthon.exe
    3⤵
    - Kills process with taskkill
    PID:2888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM slimjet.exe
    3⤵
    - Kills process with taskkill
    PID:2916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM dcbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:4432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM cŨedot.exe
    3⤵
    - Kills process with taskkill
    PID:3108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM eŬeMeJtÓ.exe
    3⤵
    - Kills process with taskkill
    PID:2596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM fenrir.exe
    3⤵
    - Kills process with taskkill
    PID:4524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM catalina.exe
    3⤵
    - Kills process with taskkill
    PID:3100
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM cůoWoJ.exe
    3⤵
    - Kills process with taskkill
    PID:3012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM liebao.exe
    3⤵
    - Kills process with taskkill
    PID:1972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM qipsurf.exe
    3⤵
    - Kills process with taskkill
    PID:3260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM 360browser.exe
    3⤵
    - Kills process with taskkill
    PID:2752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM comodo.exe
    3⤵
    - Kills process with taskkill
    PID:3508
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM qip.exe
    3⤵
    - Kills process with taskkill
    PID:3296
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM sleipnir.exe
    3⤵
    - Kills process with taskkill
    PID:1484
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3392
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5744
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:6064
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5560
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5808
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1216
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4028
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4404
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5140
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5272
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5308
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4848
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4416
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3468
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3788
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5440
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:384
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4448
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1980
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3976
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5296
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5944
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5600
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5660
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4208
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1648
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4176
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2576
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5160
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1880
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5112
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2272
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5448
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1120
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4860
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5452
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5504
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4724
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1604
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2688
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5440
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:6064
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4504
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4868
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3920
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:6076
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5844
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5784
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2364
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5700
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1708
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:408
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5340
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5300
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5352
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5312
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5328
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3488
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5460
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1532
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4712
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4188
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1196
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4112
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3384
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3788
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1400
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5052
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3012
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4000
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1964
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3716
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5848
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4728
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5724
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5060
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5072
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5752
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3712
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5292
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4784
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4356
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1064
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5480
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2092
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5392
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3184
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3228
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3912
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2432
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3136
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4180
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4684
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:224
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4616
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:6004
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5236
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5220
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5796
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5876
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5904
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3080
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4392
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1448
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5268
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5080
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1140
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5540
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4324
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4304
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5932
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5480
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3788
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1604
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1480
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2524
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4800
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4916
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:116
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4432
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4476
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1468
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4988
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5548
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1404
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5216
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5836
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5864
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2564
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5132
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4388
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4004
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2988
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1464
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5456
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5156
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3564
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3848
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5392
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4356
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2688
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1120
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5528
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3548
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:412
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4708
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4116
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2516
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:1068
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1216
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3100
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2216
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2960
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4664
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5604
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1460
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3696
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5812
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:6040
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5284
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5008
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4640
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4168
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5368
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2396
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:612
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3336
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3376
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5204
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1064
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1196
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4504
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5440
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5296
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2184
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2424
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3020
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4672
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4152
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3260
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5044
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3480
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2904
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:6088
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2200
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5936
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5248
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5692
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:2720
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4164
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4268
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3400
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1768
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5212
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3244
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5536
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5052
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3976
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3920
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3676
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:1008
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1676
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4520
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4564
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5644
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3392
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2888
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5988
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:844
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5288
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5200
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4692
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5872
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5816
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5376
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2828
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:4768
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5108
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3956
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4164
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2184
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5008
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4708
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5092
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4388
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:1480
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5540
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2432
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3488
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5512
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2804
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:5196
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:2028
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:4416
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3440
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:3024
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:3948
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    PID:2328
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:3756
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5260
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5664
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:4328
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5704
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
    3⤵
    PID:5364
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    PID:5172

C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna8837755177041764115.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8837755177041764115.dll
Size 248KB
SHA256 13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03
MD5 34d12b1e2af72d9bb267bbc8c0d53e4a
SHA1 d9ed8776645f6b4f52df16132450863c47ea92d7
SHA512 c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10
SSDEEP 6144:9RW+uZb5K8Dy+Zkt9dHlJ1ybBEleb906aslm/mFyygW:9RW+MbMOEe3Z
TLSH
T13C440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.36.0.3-a52d48e1-c5bc-4af7-95ba-7074702203be-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.36.0.3-a52d48e1-c5bc-4af7-95ba-7074702203be-sqlitejdbc.dll
Size 847KB
SHA256 b0c53ebfcddc4031daad36aac9a2967921703431deba5e51234da5008ae45b2a
MD5 71eb6b5dbae2f9266a876be1af8dc00c
SHA1 364b79fe0a21c9f9827b298d187b493f5f14ce71
SHA512 0a27205fcc33f482f59aea22de02ba3a9a1981bd28adee97ba3702026f27c760350f5df34e5982f763b608867892d5d4cebb1e13efb159fc3eef431772e37b12
SSDEEP 24576:wYv4BPSYNRINkY0H2KY7v1ksjTuMtHFCIS:SBPjNSutE7DdFC
TLSH
T13F056C13E3A255FCC97FC2718B5AE723B971F4591234FA1EA5A48B203E10E60971FB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\awt.dll
Size 1.3MB
SHA256 93cb7aa88707fa4b65284f47c332b5263f6aa1e3dd3553b3f2a617be24953292
MD5 9ca652317c1465a15e5cfe7b25e0e6fa
SHA1 a2c70b519571e8ea49ecf7ace0bf9b10502cd568
SHA512 a0909ace7f88fae16c77c2ee05f1d90177f884a95f31e29d3902e3e6528a1dc56720a8afb3ee51ba66ccbf0ab9dd47166ebeafa56fd71999a6a90696a10a9db7
SSDEEP 24576:jnE1C9wEByA2NGsbImONUvrBwEkY3e/Keh7DYzTo+WXbGe2OWGR2Vh4w:T6C9wEBINGvp3E39e5YzTodrGe2RhL
TLSH
T18D558E4BF39400A5D67FA0B8C69B521BE7B27815034097DB35B18B6E7F6BBD0623A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\java.dll
Size 164KB
SHA256 34011322c14b76443861451ef1f1f3d8e677aadb5d0151baef70345033e18dc3
MD5 671fea7a82a4f0c8b9399172d623bf02
SHA1 5b4c0f9ec303988c8fffb881f57539c81c636915
SHA512 d678bcc7c14f0a559b74299c1efe5dc452223e35ca5745731e8e9db1a8b122f60bce4cd6b5ad53aef759e808a9f7b18d77e1e5101886909560c5eddca12e99eb
SSDEEP 3072:D+rEB51KIjFg8T8hQgxzpvDNEX1VZVrsJrHkv1VMvya:9nCj+ilyWya
TLSH
T156F33A07A30240A2F547B6B8B01A510BF37AB465032D82FB43E58BAE5BAF7357D47794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe
Size 298KB
SHA256 914bf389256ca650dff1031998b92b20f1c7f7a07b9fecd5646c0e790e191c1e
MD5 289d53cd4b5a9cdf0163f61ea75f7760
SHA1 a5e4d1be3d97d48ae51ca29954d173fc033e8404
SHA512 5d4a836197f6ced6ee8f28c9023534315e0eed14222cbca18f719cf73b51ecaffae7c13e81eae2f292aa54df26985d5227c5827f0396fc80cca0856fd364247f
SSDEEP 6144:ZfCJEcziSBhFeGVIqq/RIopxW5LQmbXRNQ9ukxIvF4NsQRYHbIe7k/bCyn:ZBImUBQgXRNGDI0RbRT9n
TLSH
T1D3548C9A77A01CF5ECB7813DC851A606D7B2BC120760D68F0BE416571F333619D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\net.dll
Size 105KB
SHA256 d316a7eae35a3e0ba726ed5b3705fc6b4a64bf6b05eb1a3a9754201ccdef216a
MD5 bfe2d45c3aa1378f3ead0ec70548caab
SHA1 191e9b28dae37e83b0c0b436ef951651e07a0f54
SHA512 64b041fcd3093d2a831977ea223c47fbbe935ef21c88721a2cf3677934aa2e30b91cd8c99f86541fb98aeb8004d4fd81158364dddf4684be4177e46b06fe283a
SSDEEP 3072:OGP2HxMB8M5CYsvnjPVKzadplCJjGr0ZyQ:HORMMnjEzadp9uyQ
TLSH
T1D9B34A05732820C5FC37D2BC85968617D7B3B4702260539F13A6CA5B6FDB6B23E29B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\nio.dll
Size 66KB
SHA256 b06305aafebfbec58335fc9df07c004cb04bc03f6bb118ae519fb0387eef27e3
MD5 5eb90039a1e04960d4fe983348de5eda
SHA1 ec973f754a011a83c014c370ad6c33d95275b555
SHA512 a57ff4f50abb0702ca7c791005ef0991deb4ff3b48b4ccbe3c4b4da7f3868985ade738314957cb87d975c3d025190486624ba6ac5de1fbb7d284fd75de1c037d
SSDEEP 768:8zZSwOfnKzGtFkPHiqzc1RYKaozEOJz6N0dxOkWg/dssuWm3CCLCRx/+yVLk5S:8+czyYKVg0dxxWxtJ3CCLCn/+yN
TLSH
T1036329B257A448CBE86AB13C429A0747F433BC515510A75F43288716AB6F7B33A3E793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\server\jvm.dll
Size 8.5MB
SHA256 1e6ebf9694895dff9d7da5653cdb18e4fb6f7cd4b04b8663bc55da307ceca4bc
MD5 c5bb1cf86b8e0b00f10f09739fa982e5
SHA1 1f3fec1b2836858c2870e92f642ab43e92816ee0
SHA512 caf818367df6951e7485baa99e8f1dcfb98bb58f3b8e77554ee96439ecec056e5b2fe421ab465fbb6842f775f00575f5c1c0eb2db0599b28a98c36db6d95dcba
SSDEEP 98304:qLpFjflzwwlnV85psrEGm8unsEQMCM5Syd61//1uSe:qlFjfl8wlnV2psrLuzQMj5XdKVuSe
TLSH
T156966D2FA3704098D67EC1788E169E27D7F2BC651B3197DB12A003560F63AE5277F292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\sunec.dll
Size 142KB
SHA256 8f27991d0f3a49a724da9c1ab05e34b30822f349f71a844e4e8dbcec4a75355c
MD5 a60ae87f4200b36c0a4911dd1e0d8f78
SHA1 126da45cfa7c01696bd8e513212ebb21047840d1
SHA512 c937148cba1a81a33a32ea146b3a11aa0cbec759bed28b6930093cec89b1a5c4aaefed760bccd9507170662efc71e16fc0715f6d6c3d5054707881c6f5bcd80c
SSDEEP 3072:ZOysPp+uLm0ggM2SvsEWybheI14/QwCA8yVFayBx9:ZbsPpTLm0ggMvsE3hp1458y2y/9
TLSH
T126E35B5732E08297C9538A31C953F55AEFB0B82576E0C37B13674A44EF233D5AE2A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\sunmscapi.dll
Size 46KB
SHA256 7dbf871d6f685b234544dc03fc2be899ee11efc24f248a147a9f6bb0079278b1
MD5 e10d037ec06bca6d9ebae48a06e3c767
SHA1 f8274207ffc69bc6218f2a13bdf50c86b40f2831
SHA512 2378acce27a14efb623759131d5bd7dd789577a0f0ab8c01bb153cf023dfb8c958cc9e50436ef339a480fd213adb6da3129d4646a5dc15812a09f8d6c148c0a6
SSDEEP 768:u1XBJqEmw1l8HgA7tYynnTQfEleks0mrI/lCXu5myVLk5g1:u1XBmcKgQnnTQfNks0mrklCXu5myv1
TLSH
T1D2234B07D7A104D2FCA3C9BCC06A461BE671B5465121CB8F1361CA1ADFA3BA2773C756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
TLSH
T174936C4677A542B7D06AD278C2E35A06F770B844877063CF03B64AA94F23BE19E3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
TLSH
T16EF24B9467B88446D06B86B0C4D3AE57BE3CF9655750938F0BA4C29D1F23BD0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\verify.dll
Size 55KB
SHA256 d83cf84bb7e8480b29ca978424819f2192bbd79ddd343e8196b60808e22f376d
MD5 a8f45c6a059235e57641e766fbd41ba3
SHA1 15779320c21f34ee3c3daa788252157480f492d2
SHA512 8b8113b9ee78cb59247285ecc7396c4adf168df1fdc11b5a3c9c781371fc2751d1864001bcad4fb7464084ba0eac0997434f2fde592a205dbc30337e89e4d4a7
SSDEEP 768:aSwgV7AOEGvDDxdpX8RiVICG1LhMlpYBMX2Pt3157VyVLk5FWc:aSw4BDvDtIubGRhMlpiVPt3n7VyTc
TLSH
T13C436C57A2A00476E487C538C5635EDBDAF1F9C51B0097CB4360C6DCBF63B91EA2463A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\java\jre\bin\zip.dll
Size 88KB
SHA256 52d3e675927a49a160c42edca529df4ebc60d12467cea22f90d760801192c2b5
MD5 cbae6b772ea6ddad41dfbace3900805e
SHA1 026147a7b09cc429aefc4368833bd0d642629f39
SHA512 9578c82fe85da30b80e3470abcec5237df55af3088a187db2c57556d30f1d44bf48e80f3d0196d94ba903e55c0db399770fa6b038cd3bfbebcf84508192dcf5b
SSDEEP 1536:LwYqDQ8V1++QSI9GnFvZbcGIOQIOhnpVcn9y8:LwYSQ014SdNckGhnpV09y8
TLSH
T1D1939E565AA06151DEB699F0C5F64A2FD3B6B02013C46BCB935C97862F037A12F4C3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility.properties

Path C:\Users\Admin\AppData\Local\java\jre\lib\accessibility.properties
Size 149B
SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
MD5 2ed483df31645d3d00c625c00c1e5a14
SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
TLSH
T174C02B03F08E17B95C0C18FB01DCD4C0B38049CFC029530F54E6213A6781C38008846F
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\java\jre\lib\amd64\jvm.cfg
Size 1KB
SHA256 23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d
MD5 c60e77ff5f3887c743971e73e6f0e0b1
SHA1 9b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02
SHA512 07aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9
TLSH
T1DF31A85F9241F776065106D2394171DDE32AA3FC6219FDB8001CE79D35079B4827B4E9
MD5 SHA1 SHA512 TLSH

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\charsets.jar
Size 3.0MB
SHA256 1a5dba678da42f70d1f6bada71ab2a6a1478e713b2614e9e7c092370dee3bfe2
MD5 31bc8b813a2830ce361365d9d8ca909b
SHA1 df9127e6a3891373944f861e3aeceab13889a74d
SHA512 2c9c2213ddc0c77c81353ab2bb1274615a0c9fda54fd6d7e0108e1cd9ae018694255b114d7ca207815c2f8f4e5fc79b8ef47fc4708aa29c161de3a18238451bc
SSDEEP 49152:JOiYB4TQu4yQs76XOYOhnryic1sjJlbgOrNr:JOiQ4ss2encuVlbg0
TLSH
T17EE5AED344451E6FD60B52BF1B60EE0B670E78AA0907B240F9B95C1AEE4D72F74D2E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

currency.data

Path C:\Users\Admin\AppData\Local\java\jre\lib\currency.data
Size 4KB
SHA256 a840a4b4ef284287697cb2496a208c4d95e0c59cb4759e3ba49bf443a1012e38
MD5 80cbff688e01f2ac507813b253593035
SHA1 7c4733126e548a5c34eedac6d3a87482057882a1
SHA512 8700155e1e1ec719c06d462c8f6bb9a7e42483720c48272449b9eb7a44d682172d226cee040f2da84a12020bd550581f6042a1705b2da7f8b834b55cb865fbba
SSDEEP 48:LlWCkcBOpjIwWkQjOtF8rV5hJkg6/jVeBTpS4Am/qa+8:LlWh1jIwWkQjOtU5hJkgYVex04Am/qn8
TLSH
T169917C123745EF53F52C5732CED992ADB822CC04DB5B86C7B950732D7BBA3A45AC0680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 9614cbccab6e7ed9d0920b536c11ca9b2b8bd711871d22f0ca24a6a0b922d36e
MD5 45dfd1d26abd53f51f37a060b4feba23
SHA1 4777937c7507bb6d2f83ba0b91ee9a7b04b9ba6f
SHA512 96e12baf5e281d5cd65993f6e2afda095dc715fa5a8bc7ce962a2cae8c95aa442fb49713e405cdc3b82c7abbcf461729186334ab202d0875b2ef4d5b25a7fdba
SSDEEP 98304:1nOLIsO+HhMcXSLDhRXLNhVdEqUVOJJmZkcaSO4MTQv:V2OiMUSvrTf0UJ1lJr0v
TLSH
T1DE061292BDE54933DE23B5F00C2A9103A605C158E0D5E587C7B5CA852AF4FC39686EEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

localedata.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\localedata.jar
Size 1.1MB
SHA256 6b285aac56f8ce5b0543bb1c2d9b655739e5fd52a98b16250ab66639dbd3db5e
MD5 826444e3729a5b855b775753e86a4e5f
SHA1 e40e70ec87dbbe4ef19f95965b8d521f243229a2
SHA512 9fbefa6a76a2d1c3a42c3b9537b85cb059cd85c36d4815a5ae826c0c1a02cfa26ec816f7e5e07d1f63f8fbe3fe89732bfc8b44eea4bc66e482db052b5356b48b
SSDEEP 24576:OF21YmxpD0UhOoWx4HCUThTBgprj54WNf:OF21Y8Y+3ThTBgprbNf
TLSH
T13B45F296BED2A176D633B4F34C06C113A508C09CF499C0078774898EB5FAF975B86EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\meta-index
Size 729B
SHA256 f3c5b6ec18f23aabcb3c33ae6972c5f65fc3220196e4a3081e25341ce530cf64
MD5 c13d39595f3ab17500d6963b323558a5
SHA1 65e8806bdc09e1433e0c9c4ccbce759a3db0df98
SHA512 9e5821660a85337ad94a7d8dd488ca400e58046af7ab0785080b257c35d22462304b59d157579c3d79315a9d51bad3970988a8e45f34d8d741265f6e3ff202d1
TLSH
T10C019C5F8247902596BD8ACEE837E341620CD11E101582BE41C628CA3D8DADA2A3CE78
MD5 SHA1 SHA512 TLSH

Submit Download

sunec.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\sunec.jar
Size 38KB
SHA256 32a823c138fd768b9d0625ef1f13d0f224a8b96851ac6b77641582059febbd23
MD5 cbe36d3973b746c7ffe702545d4fc9f1
SHA1 383f677fb3127c627a3a4cc12a7397302d3fafcf
SHA512 1ed7ffc7c68357f1a47840402cfe7c808b9d8adfb730291de1cb462d483dff4e719760c4e76b0dd7df0055e7c59c1265fdcf6ed3e45edcfc70f55396e1854633
SSDEEP 768:dVsF4pC0FrI6iTlKN8kgq/g/4SlKBy1SRcVMt/gugQayQStv6XvwHs5xbhnoWE3a:dnpC0F86+gN8kg5NmyEWMtgugQayDFSL
TLSH
T1A303CE9478D805BEF447B5BBD52AC6873E1A408689DEA7BB01E0453EF858C3703356E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunjce_provider.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\sunjce_provider.jar
Size 270KB
SHA256 c7e23d7bb08b9a05130c1a7b7a83963114a7c2e1f3963949be81acb26656fbc8
MD5 dc3acad0530aa986b06b46f0cf7c1602
SHA1 2259801a0af6caf106e5c2521cca8ea030dbb5d4
SHA512 3205a50ac35438d049f01f084d8112f7b43651b1461af89f73903c526c34651d6bf3089382a536500ffbd95b6103d2ddc192c0ed269ad490b1498da05f001ec3
SSDEEP 6144:uX/e9Kwen44QEaY4Opl8jgEGVVTFJt+/xAaTdvizc:uW95244QTbOplcLGTt+/qXzc
TLSH
T10B44B0676D6EE538DD8BF4F5B872C611FE0940F8E04EB66A07D108A474AAC434B217ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\ext\sunmscapi.jar
Size 42KB
SHA256 cdf37fc553a724c1f2802f36a4fa8a8a8a3dc1f32d3ece622cd31d16c17f66ec
MD5 3936685b3a8d1a462841a828905c0aeb
SHA1 c13f4f911be8f78352d079de98d81b16a64840da
SHA512 ff9fdbbd725b70c1a8e083035c86b7818403452bad8aa59f88fed75ced81b23d52ecfd7f7d84272bf1169e4e8f5b2ba04fda84176ba13f3eb101c15a3a196690
SSDEEP 768:SbSv46ZJbH/PdylHA6w2EctYPSRPXkFRtLzUUTWbzPVvLhZ1GmEughtAlaFNBmNo:SbSv46LbH/PdyFBw2EX4kFRtLzUUojV4
TLSH
T12B13BEA7AD9CC0A8F417A877C42281673B5C06C9DCC6A36B1B50CA49F61CDA34711FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\jce.jar
Size 94KB
SHA256 3f76f0230ac5f184d9d4235abc85c0c88b9750b7d0070bedc6fa1df04bf540c1
MD5 12698c943e65b2825046b694ce429038
SHA1 908696770356fb77aa49f4d9e534ee70e65f9f44
SHA512 f3c36cf2535a66fd20b522a37b8672a73908c3b140bbc4f26ddce8a812d6afab5679fe3dedad6fcee5cd914f5cc01d093c7fb1b65eafd4883a097fd4e70eadb0
SSDEEP 1536:/y8eNOC2BVWq6AcySDuJrBt6se6shfny7T9gt7/VpTU0w/kkbrWw+bSPJUZKvzFS:qj2BVWluJr3GhfggRVpCPWwcK5el
TLSH
T1BC93D0A46D85EE25EF53F03ADD71CA33BC0D4098A18ADB0347B584E974B4ED49E12BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\jfr.jar
Size 868KB
SHA256 f2f591ac257f084401d7530b2ecab5ccc6ec9d520df2ff562bf1663fc68b8685
MD5 60753548dd47e41d6cd5f26ab9c78ce9
SHA1 525b0770a3fe6b99883685809082ca53011051f0
SHA512 0ebda6c5bedbe27c955f5db4b5cefd4309dc5f7275120d206110df3aceee6929df9c49d079577a536bb8f965b8a69de142a41dd08e3e6a1e5979599f98e9ae89
SSDEEP 6144:6tQikMDdblCmrKPHh4NFQ1yF96Cu1sOqpalLZ5Xy4N585D8IWXWfzm4EVpEFI99f:CLdUmzQU5u1cpYwjKuFJuj
TLSH
T1FD15E617F0461E53E181EBBA1961072422B0E0F24187E950AF7F9D56ADE31CBCE59BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\jsse.jar
Size 1.8MB
SHA256 c8d327be03a7317de160d4c1547ea2c557d4310be5561516f63f9ccac7c667ec
MD5 05ac7021568b42a15656ea95f1355104
SHA1 0c171188b836d5a75a5b756b37b06130c4bd5f1c
SHA512 fffbcaf92a9b464f3d8ab644e499468e5cfbc0edab81197d091ecc56820e13b5247d5c47e01e05d4475af7585a0b90c01241a364f4526b3da7210d5b5a079a4e
SSDEEP 12288:byTnhqT0coAY3ywKGuhIsTMpDT/DWGqz6x5Zs6t:ezhqBMHK/PSXDWGqm5ZsU
TLSH
T1EF95A417E50C99BFF250DAFFEC70422833349C325D63B3384A49491AF5DA6B15A78AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Local\java\jre\lib\logging.properties
Size 2KB
SHA256 ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232
MD5 809c50033f825eff7fc70419aaf30317
SHA1 89da8094484891f9ec1fa40c6c8b61f94c5869d0
SHA512 c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c
TLSH
T17F510E6E9B4E2D35430A00AA9E6FF5967E2898BC1C23E5B6B39E6304310D43885D77C2
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Local\java\jre\lib\meta-index
Size 1KB
SHA256 dff270e76bd7d851cbcf79702aebd71122c3a9e93836ae4e9f650234a754b5c3
MD5 83964354d8e8e69dfc1001f01682bd70
SHA1 1f2012a464683ccc1c284d51b20778811641b2ee
SHA512 4be6e0c8ed2bd2f59286bbfa5041676f352e32731e070d7c26511e1e570bd8d6940ff2cc59b0e1656c9c8b3f86186a34709dbf19c303d80840307dacc39d9956
TLSH
T10441496B0287842F5E9849CBB977DB9647E8843618D863FD43E45C8179CDD4B0738A74
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Local\java\jre\lib\net.properties
Size 6KB
SHA256 f4567500fd182e9912c7ed58633eba1737619ebefc79c52a583df54a0226127a
MD5 40ecda055b0667a3cc0b272cf4fe415e
SHA1 9aa14cc3fe10b8d097555e273026b5507ab7d09d
SHA512 7dc981cb41848a66484c2a3e85a3dcff76a10a23cf9f800f1933d985b380ef77a8e2145a03ca430eac0c5e2895a323c500fdf7d38e9675f2c971da143ff54e03
SSDEEP 192:YEVGG4f4z34m04Pet5m27SRgTe93hf7k9Ss:5GGGYCSgY3hzk9v
TLSH
T197D141C2FE466635436DC291D22EA7E9E72C907D4C33A5A871AC850D261AC7A422F4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\resources.jar
Size 3.4MB
SHA256 f86ae335f06f22cfd4d35507242a529963b4ee76765a2f9d17bac742a7835f7c
MD5 763b38089e25b8daccf6e5eb4ede8951
SHA1 6f86f4bfdea19d81bad00ccf628b5366b40f27a9
SHA512 7b6603ede9a05098d9a55adb7079b2c81809496859a190063c6ca9b74c7f4933c1b29268f47d359647bb55a5ee90e83ec702b5890181aeb94b0a7bb309c80196
SSDEEP 49152:qpNy4pH4WD8FKTE9Ak5V9HYNLH8h6fQ8o67H0Wbop563io/fBab9IzPj8ryp7Hzt:0DKlm3z
TLSH
T188F54B6FB902112BCAB340B6EC3326C7E96019B183A2D627F1EC9F663F8485D5767354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blacklisted.certs

Path C:\Users\Admin\AppData\Local\java\jre\lib\security\blacklisted.certs
Size 2KB
SHA256 96572f243f31c2ef81a6e627542e596f6a9295cff3c7ae095c1b595cb1457ded
MD5 19e78890d61c0dfc65b291341c08beba
SHA1 ee0288462fc32992a0f9dfab5aeb3385412f0c4f
SHA512 c6d8d4ee0eb7eeb14532512ff4310dff9dd4f31d112716fc67a1052d37eef18d4bd6eb58301c76167ad35d31e73f5b28993f4da8c5de2dbe3836a5ef7e9c8b7e
TLSH
T154512CC6D19E42C6AD4027D604FC42A777A38171AB3814283EEA0F830573C5DD22F8CA
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts

Path C:\Users\Admin\AppData\Local\java\jre\lib\security\cacerts
Size 175KB
SHA256 818a963a843719f4b85f17a0d025cdcfef5a9e8270d79d3d209eaf0db7c2a881
MD5 4ec02e647b5d6a002f8f88010bfc5423
SHA1 688c606982973b4f886f24a06a49b968f59f8780
SHA512 e80a6c8e0f5e4a8243739ce72e0577c74b23502e43d79b391e7a602c176fae2201338568e779331fb670c174ef229e10022734f087f18c936734578297937220
SSDEEP 3072:/U6030npKQxPQ/lZ/bJaZW65mSJ2TCE9/LoF3FzoGibGVT/l/BTLlylbIA1:WIpKQkbbwZW65mSJ2RMFaP6l/lZTLUL1
TLSH
T11B049D8B4F383851BFD6EE64A688D5373DB9B7D5669B28132121C0E16D927F07E8C01E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Local\java\jre\lib\security\java.security
Size 54KB
SHA256 a42030fe33f7773b422e6c024da46118a4b8bb16560f85d8cbad99e81f0a5b6f
MD5 c9e99bd20123f8aad3ce98e8b29b5590
SHA1 221925ffb63b1fb71b01fc30e6f6f99aa6d0a24b
SHA512 f7a7bc30c5b4ad439bd05932c8952d54032357d8e8c1ece592106a29a3a811962c1c11fe613f54646b8beb7ee9ac59b5c07ba01bdb96fe8fc22a739dcc51f470
SSDEEP 768:Y8obod6U3O5O9Wgw2+JuN2gQ01pdYRE0G+fqRWHo69QZW93jfGgqcNhXLJ4TP1z8:Y2pD2RG+fqRWI1Ze6hczKTP1KqJwF/
TLSH
T14C431923FB4A3B7005C21193655E83EDAB2C617B22725598769D8A1CB707C71C33B7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\security\policy\unlimited\US_export_policy.jar
Size 612B
SHA256 287820d058511751e239d084c7d0146a27e1e7d4363fbf609556e06ab0668064
MD5 a4d2a795530bb6f4d85ded72d130d415
SHA1 3e605eb843599b6ff293c793425a575aa7ec64ee
SHA512 82c8b872c484064b21bd037e270e8444767837bf8d5b4967094e2c49d0e32fdc3bf613519f9f01509c2350aeb2dec80e06ffc63126cd1b87a2fabb6b13d21384
TLSH
T186F0C07D6BC4C800FE1A7130A6D383079B1A250C264CD74B8D01A2642924EC00A13EDF
MD5 SHA1 SHA512 TLSH

Submit Download

local_policy.jar

Path C:\Users\Admin\AppData\Local\java\jre\lib\security\policy\unlimited\local_policy.jar
Size 630B
SHA256 ce82d6c4054858015c1efce0ce6e22c366418250ca83e8d706c9dc8b4ffc47cb
MD5 9d940ec546add97b75c5c28f775fc583
SHA1 af92e419957c146cf519e15b1a6c8fba38dd053b
SHA512 20a55cce3b1eae44d4169d13d776d579a87a4b141e4e0fe0475cd68d76c695bc43494cf670e66c727554482a906e5bd1368e849b9ce49e2548b2f3aa204432ae
TLSH
T102F02BAC3ECFDD58FE17B4B5A5835616EF2A0558024CD30BD90060C9AA74DC41B67ACF
MD5 SHA1 SHA512 TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\java\jre\lib\tzdb.dat
Size 100KB
SHA256 be2f2d67cddbf5cdc665b947817f067b13b57bc7f4fb0e0b4ed3dc6c93010598
MD5 d12990feceebf94b797fda7b5512f03d
SHA1 a2b13ceec7aa38f1a211341f3dc6d9ab5e1a1103
SHA512 569ed6f4b5cc8df12b175a3378b7cf2bc74d63eb75568461e0718f05d07db842e2316485bd8dccc8aafd3f7b0b5336e880f8cec85081fcd0490ba23103929e18
SSDEEP 1536:n0EkmNeZM5XPmbPkR6mK2XJPDLuYFj/////Z+pL5Erf9hm9euL0GwH:nWZePmzIKIxDLuYFylErf9490
TLSH
T14AA3C4757F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\java\jre\lib\tzmappings
Size 9KB
SHA256 83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a
MD5 62bc9fa21191d34f1db3ed7ad5106efa
SHA1 750cc36b35487d6054e039469039aece3a0cc9e9
SHA512 af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3
SSDEEP 192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4SV0l2:qqgniTyq06a2
TLSH
T19C120F017260A6CAC5B3AC0F3B467397F416B2D81CC19B6C3A2BC76B5D059B652E1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.jar

Path C:\Users\Admin\AppData\Local\update.jar
Size 24.6MB
SHA256 b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433
MD5 71d8a02cb6d6f3f5cb071395572aa0b4
SHA1 6e247911839419f46f1a3a56f76a819305738fdd
SHA512 c180e850de921890dca7dc8b2bf9119a6c1c6b2d86fd959690f245d126767dd5c85431f7ca4c159088c17d5f16f933dbc2c2a170003ff0d76948373fcf49371b
SSDEEP 786432:KxH2T6eobChbL5VJSIGEjXYZaa7NUoPN4jP:UHh7bCNMIdOR+oqP
TLSH
T16B471212D856883FE583E27678829FE6F83953D5E14B912B07F00993F6829CE4B3275D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3964-755-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-780-0x0000000070BC0000-0x0000000070C9C000-memory.dmp

Download

memory/3964-512-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-552-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-563-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-671-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-670-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-678-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-684-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-698-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-701-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-704-0x0000029A3F450000-0x0000029A3F458000-memory.dmp

Download

memory/3964-705-0x0000029A3F460000-0x0000029A3F46C000-memory.dmp

Download

memory/3964-706-0x0000000070BC0000-0x0000000070C9C000-memory.dmp

Download

memory/3964-710-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-718-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-723-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-595-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-775-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-982-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-784-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-790-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-793-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-794-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-800-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-805-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-798-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-797-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-841-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-834-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-859-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-864-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-865-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-875-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-885-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-895-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-926-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/3964-936-0x0000029A3F3D0000-0x0000029A3F3D1000-memory.dmp

Download

memory/4824-645-0x000001C427920000-0x000001C427921000-memory.dmp

Download