b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/update.jar
Size 24.6MB
Sample260407-s8dpgahs5l
SHA256 b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433
MD5 71d8a02cb6d6f3f5cb071395572aa0b4
SHA1 6e247911839419f46f1a3a56f76a819305738fdd
SHA512 c180e850de921890dca7dc8b2bf9119a6c1c6b2d86fd959690f245d126767dd5c85431f7ca4c159088c17d5f16f933dbc2c2a170003ff0d76948373fcf49371b
SSDEEP 786432:KxH2T6eobChbL5VJSIGEjXYZaa7NUoPN4jP:UHh7bCNMIdOR+oqP
TLSH
T16B471212D856883FE583E27678829FE6F83953D5E14B912B07F00993F6829CE4B3275D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3968	java.exe
3968	java.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	discord.com
51	discord.com
9	discord.com
12	discord.com
32	discord.com
37	discord.com
40	discord.com
41	discord.com
50	discord.com
52	discord.com
10	discord.com
11	discord.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
5292	tasklist.exe
5636	tasklist.exe
4136	tasklist.exe
2316	tasklist.exe
1652	tasklist.exe
4052	tasklist.exe
5716	tasklist.exe
4936	tasklist.exe
748	tasklist.exe
2500	tasklist.exe
6040	tasklist.exe
3588	tasklist.exe
6012	tasklist.exe
5484	tasklist.exe
3804	tasklist.exe
1148	tasklist.exe
3620	tasklist.exe
5880	tasklist.exe
4896	tasklist.exe
4752	tasklist.exe
928	tasklist.exe
1860	tasklist.exe
6140	tasklist.exe
5300	tasklist.exe
5108	tasklist.exe
6016	tasklist.exe
5928	tasklist.exe
3384	tasklist.exe
3472	tasklist.exe
3240	tasklist.exe
3964	tasklist.exe
2732	tasklist.exe
2316	tasklist.exe
5068	tasklist.exe
1424	tasklist.exe
4676	tasklist.exe
2200	tasklist.exe
5888	tasklist.exe
5600	tasklist.exe
1644	tasklist.exe
1236	tasklist.exe
4348	tasklist.exe
5368	tasklist.exe
5292	tasklist.exe
5172	tasklist.exe
5368	tasklist.exe
3944	tasklist.exe
5536	tasklist.exe
4348	tasklist.exe
896	tasklist.exe
5980	tasklist.exe
3516	tasklist.exe
2196	tasklist.exe
2864	tasklist.exe
3332	tasklist.exe
5996	tasklist.exe
5332	tasklist.exe
5276	tasklist.exe
4512	tasklist.exe
1824	tasklist.exe
4300	tasklist.exe
5060	tasklist.exe
6008	tasklist.exe
3724	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 46 IoCs

defense_evasion

pid	Process
4392	taskkill.exe
1872	taskkill.exe
3784	taskkill.exe
2700	taskkill.exe
2620	taskkill.exe
3036	taskkill.exe
3300	taskkill.exe
3472	taskkill.exe
1812	taskkill.exe
1844	taskkill.exe
2980	taskkill.exe
1200	taskkill.exe
1356	taskkill.exe
2584	taskkill.exe
2388	taskkill.exe
632	taskkill.exe
4884	taskkill.exe
3824	taskkill.exe
2468	taskkill.exe
3320	taskkill.exe
4540	taskkill.exe
328	taskkill.exe
3708	taskkill.exe
3916	taskkill.exe
396	taskkill.exe
4524	taskkill.exe
4528	taskkill.exe
3940	taskkill.exe
704	taskkill.exe
3344	taskkill.exe
2320	taskkill.exe
848	taskkill.exe
444	taskkill.exe
2456	taskkill.exe
3148	taskkill.exe
4416	taskkill.exe
4252	taskkill.exe
216	taskkill.exe
3444	taskkill.exe
3672	taskkill.exe
4468	taskkill.exe
1112	taskkill.exe
1104	taskkill.exe
3796	taskkill.exe
3960	taskkill.exe
4920	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2116	schtasks.exe
3724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3968	java.exe
3968	java.exe
3968	java.exe
3968	java.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeDebugPrivilege	928	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4300	WMIC.exe
Token: SeSecurityPrivilege	4300	WMIC.exe
Token: SeTakeOwnershipPrivilege	4300	WMIC.exe
Token: SeLoadDriverPrivilege	4300	WMIC.exe
Token: SeSystemProfilePrivilege	4300	WMIC.exe
Token: SeSystemtimePrivilege	4300	WMIC.exe
Token: SeProfSingleProcessPrivilege	4300	WMIC.exe
Token: SeIncBasePriorityPrivilege	4300	WMIC.exe
Token: SeCreatePagefilePrivilege	4300	WMIC.exe
Token: SeBackupPrivilege	4300	WMIC.exe
Token: SeRestorePrivilege	4300	WMIC.exe
Token: SeShutdownPrivilege	4300	WMIC.exe
Token: SeDebugPrivilege	4300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4300	WMIC.exe
Token: SeRemoteShutdownPrivilege	4300	WMIC.exe
Token: SeUndockPrivilege	4300	WMIC.exe
Token: SeManageVolumePrivilege	4300	WMIC.exe
Token: 33	4300	WMIC.exe
Token: 34	4300	WMIC.exe
Token: 35	4300	WMIC.exe
Token: 36	4300	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3968	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5000	3968	java.exe	86
PID 3968 wrote to memory of 2116	3968	java.exe	88
PID 3968 wrote to memory of 3724	3968	java.exe	92
PID 3968 wrote to memory of 928	3968	java.exe	94
PID 3968 wrote to memory of 4300	3968	java.exe	96
PID 3968 wrote to memory of 3600	3968	java.exe	99
PID 3968 wrote to memory of 3284	3968	java.exe	101
PID 3968 wrote to memory of 1112	3968	java.exe	103
PID 3968 wrote to memory of 444	3968	java.exe	105
PID 3968 wrote to memory of 3436	3968	java.exe	107
PID 3968 wrote to memory of 1304	3968	java.exe	109
PID 3968 wrote to memory of 2452	3968	java.exe	111
PID 3968 wrote to memory of 2320	3968	java.exe	113
PID 3968 wrote to memory of 4348	3968	java.exe	115
PID 3968 wrote to memory of 4248	3968	java.exe	117
PID 3968 wrote to memory of 3672	3968	java.exe	119
PID 3968 wrote to memory of 3916	3968	java.exe	121
PID 3968 wrote to memory of 216	3968	java.exe	123
PID 3968 wrote to memory of 3716	3968	java.exe	125
PID 3968 wrote to memory of 1396	3968	java.exe	127
PID 3968 wrote to memory of 3940	3968	java.exe	129
PID 3968 wrote to memory of 3824	3968	java.exe	131
PID 3968 wrote to memory of 3036	3968	java.exe	133
PID 3968 wrote to memory of 3300	3968	java.exe	135
PID 3968 wrote to memory of 4056	3968	java.exe	137
PID 3968 wrote to memory of 1860	3968	java.exe	139
PID 3968 wrote to memory of 4756	3968	java.exe	141
PID 3968 wrote to memory of 3756	3968	java.exe	143
PID 3968 wrote to memory of 396	3968	java.exe	145
PID 3968 wrote to memory of 704	3968	java.exe	147
PID 3968 wrote to memory of 3748	3968	java.exe	149
PID 3968 wrote to memory of 3816	3968	java.exe	151
PID 3968 wrote to memory of 4524	3968	java.exe	153
PID 3968 wrote to memory of 3444	3968	java.exe	155
PID 3968 wrote to memory of 2368	3968	java.exe	156
PID 3968 wrote to memory of 1424	3968	java.exe	159
PID 3968 wrote to memory of 3796	3968	java.exe	161
PID 3968 wrote to memory of 4884	3968	java.exe	162
PID 3968 wrote to memory of 3960	3968	java.exe	163
PID 3968 wrote to memory of 3344	3968	java.exe	165
PID 3968 wrote to memory of 1104	3968	java.exe	168
PID 3968 wrote to memory of 3672	3968	java.exe	170
PID 3968 wrote to memory of 1112	3968	java.exe	172
PID 3968 wrote to memory of 444	3968	java.exe	174
PID 3968 wrote to memory of 848	3968	java.exe	175
PID 3968 wrote to memory of 4468	3968	java.exe	176
PID 3968 wrote to memory of 3472	3968	java.exe	177
PID 3968 wrote to memory of 2320	3968	java.exe	178
PID 3968 wrote to memory of 1812	3968	java.exe	179
PID 3968 wrote to memory of 2584	3968	java.exe	181
PID 3968 wrote to memory of 3708	3968	java.exe	188
PID 3968 wrote to memory of 2388	3968	java.exe	189
PID 3968 wrote to memory of 2700	3968	java.exe	190
PID 3968 wrote to memory of 4528	3968	java.exe	194
PID 3968 wrote to memory of 4540	3968	java.exe	196
PID 3968 wrote to memory of 3784	3968	java.exe	197
PID 3968 wrote to memory of 1872	3968	java.exe	198
PID 3968 wrote to memory of 3320	3968	java.exe	199
PID 3968 wrote to memory of 1200	3968	java.exe	200
PID 3968 wrote to memory of 2980	3968	java.exe	201
PID 3968 wrote to memory of 4416	3968	java.exe	202
PID 3968 wrote to memory of 2468	3968	java.exe	210
PID 3968 wrote to memory of 4768	3968	java.exe	212
PID 3968 wrote to memory of 328	3968	java.exe	214

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\update.jar
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2116
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3724
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3600
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3284
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1112
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:444
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3436
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1304
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2452
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2320
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4348
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4248
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3672
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:3916
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  PID:216
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3716
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3940
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  PID:3824
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM zen.exe /T
  2⤵
  - Kills process with taskkill
  PID:3036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  PID:3300
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1860
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3756
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  PID:704
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3748
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3816
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe /T
  2⤵
  - Kills process with taskkill
  PID:4524
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ůŰeRa eØe /T
  2⤵
  - Kills process with taskkill
  PID:3444
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2368
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1424
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:3796
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:4884
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:3960
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŧũrefox.exe
  2⤵
  - Kills process with taskkill
  PID:3344
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM oŰera.exe
  2⤵
  - Kills process with taskkill
  PID:1104
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - Kills process with taskkill
  PID:3672
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ůŲBIPQÍ.exe
  2⤵
  - Kills process with taskkill
  PID:1112
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:444
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - Kills process with taskkill
  PID:848
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - Kills process with taskkill
  PID:4468
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:3472
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - Kills process with taskkill
  PID:2320
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - Kills process with taskkill
  PID:1812
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:2584
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - Kills process with taskkill
  PID:3708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM šŭiGo.exe
  2⤵
  - Kills process with taskkill
  PID:2388
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŵorch.exe
  2⤵
  - Kills process with taskkill
  PID:2700
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ŷaterfox.exe
  2⤵
  - Kills process with taskkill
  PID:4528
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM palemoon.exe
  2⤵
  - Kills process with taskkill
  PID:4540
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM librewolf.exe
  2⤵
  - Kills process with taskkill
  PID:3784
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŵůr.exe
  2⤵
  - Kills process with taskkill
  PID:1872
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chromium.exe
  2⤵
  - Kills process with taskkill
  PID:3320
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:1200
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:2980
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM dcbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4416
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM cŨedot.exe
  2⤵
  - Kills process with taskkill
  PID:2468
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4768
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM eŬeMeJtÓ.exe
  2⤵
  - Kills process with taskkill
  PID:328
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM fenrir.exe
  2⤵
  - Kills process with taskkill
  PID:4392
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM catalina.exe
  2⤵
  - Kills process with taskkill
  PID:3148
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM cůoWoJ.exe
  2⤵
  - Kills process with taskkill
  PID:4920
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM liebao.exe
  2⤵
  - Kills process with taskkill
  PID:2456
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM qipsurf.exe
  2⤵
  - Kills process with taskkill
  PID:4252
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:1844
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM comodo.exe
  2⤵
  - Kills process with taskkill
  PID:1356
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM qip.exe
  2⤵
  - Kills process with taskkill
  PID:2620
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM sleipnir.exe
  2⤵
  - Kills process with taskkill
  PID:632
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6072
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5276
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5512
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2132
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4348
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5528
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:932
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3240
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2724
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5500
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3724
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4024
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3204
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2464
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5312
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:748
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1592
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5448
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4676
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2196
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3800
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2864
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5344
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:756
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1508
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6140
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3804
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4036
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2316
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2444
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1652
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:772
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5300
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5316
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4588
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5412
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:896
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3760
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1112
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3784
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5276
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4024
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4052
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6068
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2200
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5368
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5568
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5860
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5732
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4840
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5644
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3964
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4488
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:212
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:628
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2988
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2508
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4420
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5420
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1840
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3444
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3440
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2700
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3320
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1432
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5132
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6024
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4300
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6080
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6128
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4736
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5900
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5716
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3588
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2044
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5292
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5600
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5680
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2500
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5136
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2108
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5980
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5400
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5308
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5112
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4136
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1812
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3240
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3724
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1184
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:620
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1632
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:644
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3848
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5888
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5692
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3332
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5672
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4476
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2432
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4128
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4176
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5028
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1148
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4312
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5108
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5172
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5032
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5716
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3964
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:896
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1508
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6040
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1672
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2320
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5076
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2464
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:900
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6016
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3008
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5996
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5944
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:880
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2460
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:824
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2732
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5188
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4684
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3000
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3136
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4432
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5340
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5600
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5420
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5368
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6140
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3944
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2528
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4512
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3708
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:328
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6064
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4472
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3620
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6000
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1120
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5664
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:220
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5544
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5536
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3508
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5976
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5396
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1644
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2960
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5972
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2596
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4560
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3588
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2108
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5880
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2316
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5392
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3472
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2436
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:636
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4520
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4108
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3176
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1236
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5372
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6012
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4860
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4912
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1080
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2208
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2536
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4248
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2112
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5928
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5116
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3224
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5292
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5860
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3516
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:396
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1684
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2388
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5332
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4996
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4896
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3572
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6084
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5484
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5992
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5636
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1812
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4312
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4536
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5944
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4680
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4668
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5372
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1824
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2928
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4460
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3808
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3832
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3384
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5164
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5060
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5228
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6128
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5240
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6080
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3036
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4936
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4932
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4540
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5500
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4964
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2504
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5360
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4720
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6008
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1000
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4476
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5032
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3548
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4752
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5544
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3472
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:712
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5660
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5160
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5068
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:648
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna7450693660478197541.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna7450693660478197541.dll
Size 248KB
SHA256 13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03
MD5 34d12b1e2af72d9bb267bbc8c0d53e4a
SHA1 d9ed8776645f6b4f52df16132450863c47ea92d7
SHA512 c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10
SSDEEP 6144:9RW+uZb5K8Dy+Zkt9dHlJ1ybBEleb906aslm/mFyygW:9RW+MbMOEe3Z
TLSH
T13C440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.36.0.3-b906924e-4ddd-4729-9787-b7b4a90e9f1e-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.36.0.3-b906924e-4ddd-4729-9787-b7b4a90e9f1e-sqlitejdbc.dll
Size 847KB
SHA256 b0c53ebfcddc4031daad36aac9a2967921703431deba5e51234da5008ae45b2a
MD5 71eb6b5dbae2f9266a876be1af8dc00c
SHA1 364b79fe0a21c9f9827b298d187b493f5f14ce71
SHA512 0a27205fcc33f482f59aea22de02ba3a9a1981bd28adee97ba3702026f27c760350f5df34e5982f763b608867892d5d4cebb1e13efb159fc3eef431772e37b12
SSDEEP 24576:wYv4BPSYNRINkY0H2KY7v1ksjTuMtHFCIS:SBPjNSutE7DdFC
TLSH
T13F056C13E3A255FCC97FC2718B5AE723B971F4591234FA1EA5A48B203E10E60971FB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-263-0x0000015CDC010000-0x0000015CDC0DD000-memory.dmp

Download

memory/396-325-0x0000016F08180000-0x0000016F0824D000-memory.dmp

Download

memory/444-349-0x000001BCC3FE0000-0x000001BCC40AD000-memory.dmp

Download

memory/704-334-0x000002A37A9C0000-0x000002A37AA8D000-memory.dmp

Download

memory/848-355-0x000001D41BCD0000-0x000001D41BD9D000-memory.dmp

Download

memory/928-215-0x0000020287420000-0x00000202874ED000-memory.dmp

Download

memory/1104-350-0x0000027AF6390000-0x0000027AF645D000-memory.dmp

Download

memory/1112-241-0x000001FC1F270000-0x000001FC1F33D000-memory.dmp

Download

memory/1112-353-0x00000221C94E0000-0x00000221C95AD000-memory.dmp

Download

memory/1396-313-0x000002755E9C0000-0x000002755EA8D000-memory.dmp

Download

memory/1424-341-0x0000022CE6DC0000-0x0000022CE6E8D000-memory.dmp

Download

memory/1812-352-0x000001D90C1D0000-0x000001D90C29D000-memory.dmp

Download

memory/1860-320-0x00000155898F0000-0x00000155899BD000-memory.dmp

Download

memory/2320-358-0x000001E30C180000-0x000001E30C24D000-memory.dmp

Download

memory/2388-357-0x000001961B3B0000-0x000001961B47D000-memory.dmp

Download

memory/2452-249-0x00000193DDDC0000-0x00000193DDE8D000-memory.dmp

Download

memory/2468-360-0x00000147D6530000-0x00000147D65FD000-memory.dmp

Download

memory/2584-346-0x000002DFB2BF0000-0x000002DFB2CBD000-memory.dmp

Download

memory/2620-364-0x00000250CEEB0000-0x00000250CEF7D000-memory.dmp

Download

memory/2700-365-0x000001DAFB8D0000-0x000001DAFB99D000-memory.dmp

Download

memory/2980-362-0x0000019413860000-0x000001941392D000-memory.dmp

Download

memory/3036-318-0x000001F3E94E0000-0x000001F3E95AD000-memory.dmp

Download

memory/3300-319-0x000002130C1C0000-0x000002130C28D000-memory.dmp

Download

memory/3344-343-0x0000023C4C840000-0x0000023C4C90D000-memory.dmp

Download

memory/3436-246-0x000001A81A4E0000-0x000001A81A5AD000-memory.dmp

Download

memory/3444-340-0x0000026EA5C50000-0x0000026EA5D1D000-memory.dmp

Download

memory/3472-356-0x000001CD71560000-0x000001CD7162D000-memory.dmp

Download

memory/3600-231-0x0000025C10B30000-0x0000025C10BFD000-memory.dmp

Download

memory/3672-266-0x0000027AAF160000-0x0000027AAF22D000-memory.dmp

Download

memory/3672-347-0x000001B656DA0000-0x000001B656E6D000-memory.dmp

Download

memory/3708-359-0x000001CF217B0000-0x000001CF2187D000-memory.dmp

Download

memory/3756-322-0x000001E5807D0000-0x000001E58089D000-memory.dmp

Download

memory/3784-363-0x0000028813430000-0x00000288134FD000-memory.dmp

Download

memory/3796-351-0x00000229CF9B0000-0x00000229CFA7D000-memory.dmp

Download

memory/3816-335-0x000001A9DE940000-0x000001A9DEA0D000-memory.dmp

Download

memory/3824-304-0x000002ACD8150000-0x000002ACD821D000-memory.dmp

Download

memory/3916-262-0x0000023BF5FF0000-0x0000023BF60BD000-memory.dmp

Download

memory/3940-295-0x0000024A50700000-0x0000024A507CD000-memory.dmp

Download

memory/3960-348-0x00000262E48B0000-0x00000262E497D000-memory.dmp

Download

memory/3968-75-0x0000015055430000-0x0000015055440000-memory.dmp

Download

memory/3968-240-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-80-0x0000015055450000-0x0000015055460000-memory.dmp

Download

memory/3968-84-0x0000015055500000-0x0000015055510000-memory.dmp

Download

memory/3968-83-0x0000015055460000-0x0000015055470000-memory.dmp

Download

memory/3968-87-0x0000015055510000-0x0000015055520000-memory.dmp

Download

memory/3968-86-0x0000015055470000-0x0000015055480000-memory.dmp

Download

memory/3968-90-0x0000015055480000-0x0000015055490000-memory.dmp

Download

memory/3968-93-0x0000015055490000-0x00000150554A0000-memory.dmp

Download

memory/3968-92-0x0000015055530000-0x0000015055540000-memory.dmp

Download

memory/3968-91-0x0000015055520000-0x0000015055530000-memory.dmp

Download

memory/3968-96-0x0000015055540000-0x0000015055550000-memory.dmp

Download

memory/3968-95-0x00000150554A0000-0x00000150554B0000-memory.dmp

Download

memory/3968-99-0x0000015055550000-0x0000015055560000-memory.dmp

Download

memory/3968-98-0x00000150554B0000-0x00000150554C0000-memory.dmp

Download

memory/3968-102-0x0000015055560000-0x0000015055570000-memory.dmp

Download

memory/3968-101-0x00000150554C0000-0x00000150554D0000-memory.dmp

Download

memory/3968-104-0x00000150554D0000-0x00000150554E0000-memory.dmp

Download

memory/3968-105-0x0000015055570000-0x0000015055580000-memory.dmp

Download

memory/3968-108-0x0000015055580000-0x0000015055590000-memory.dmp

Download

memory/3968-107-0x00000150554E0000-0x00000150554F0000-memory.dmp

Download

memory/3968-111-0x0000015055590000-0x00000150555A0000-memory.dmp

Download

memory/3968-110-0x00000150554F0000-0x0000015055500000-memory.dmp

Download

memory/3968-113-0x0000015055500000-0x0000015055510000-memory.dmp

Download

memory/3968-114-0x00000150555A0000-0x00000150555B0000-memory.dmp

Download

memory/3968-116-0x0000015055510000-0x0000015055520000-memory.dmp

Download

memory/3968-117-0x00000150555B0000-0x00000150555C0000-memory.dmp

Download

memory/3968-120-0x00000150555C0000-0x00000150555D0000-memory.dmp

Download

memory/3968-119-0x0000015055520000-0x0000015055530000-memory.dmp

Download

memory/3968-122-0x0000015055530000-0x0000015055540000-memory.dmp

Download

memory/3968-123-0x00000150555D0000-0x00000150555E0000-memory.dmp

Download

memory/3968-125-0x0000015055540000-0x0000015055550000-memory.dmp

Download

memory/3968-126-0x00000150555E0000-0x00000150555F0000-memory.dmp

Download

memory/3968-129-0x0000015055550000-0x0000015055560000-memory.dmp

Download

memory/3968-130-0x00000150555F0000-0x0000015055600000-memory.dmp

Download

memory/3968-131-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-134-0x0000015055600000-0x0000015055610000-memory.dmp

Download

memory/3968-133-0x0000015055560000-0x0000015055570000-memory.dmp

Download

memory/3968-136-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-138-0x0000015055570000-0x0000015055580000-memory.dmp

Download

memory/3968-139-0x0000015055610000-0x0000015055620000-memory.dmp

Download

memory/3968-142-0x0000015055580000-0x0000015055590000-memory.dmp

Download

memory/3968-148-0x0000015055640000-0x0000015055650000-memory.dmp

Download

memory/3968-147-0x00000150555A0000-0x00000150555B0000-memory.dmp

Download

memory/3968-144-0x0000015055590000-0x00000150555A0000-memory.dmp

Download

memory/3968-143-0x0000015055620000-0x0000015055630000-memory.dmp

Download

memory/3968-146-0x0000015055630000-0x0000015055640000-memory.dmp

Download

memory/3968-154-0x0000015055650000-0x0000015055660000-memory.dmp

Download

memory/3968-153-0x00000150555B0000-0x00000150555C0000-memory.dmp

Download

memory/3968-78-0x00000150554E0000-0x00000150554F0000-memory.dmp

Download

memory/3968-187-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-192-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-198-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-2-0x00000150550E0000-0x0000015055350000-memory.dmp

Download

memory/3968-76-0x00000150554D0000-0x00000150554E0000-memory.dmp

Download

memory/3968-221-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-224-0x00000150555C0000-0x00000150555D0000-memory.dmp

Download

memory/3968-225-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-226-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-73-0x00000150554C0000-0x00000150554D0000-memory.dmp

Download

memory/3968-233-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-81-0x00000150554F0000-0x0000015055500000-memory.dmp

Download

memory/3968-71-0x00000150554B0000-0x00000150554C0000-memory.dmp

Download

memory/3968-242-0x00000150555D0000-0x00000150555E0000-memory.dmp

Download

memory/3968-70-0x0000015055410000-0x0000015055420000-memory.dmp

Download

memory/3968-247-0x00000150555E0000-0x00000150555F0000-memory.dmp

Download

memory/3968-69-0x0000015055420000-0x0000015055430000-memory.dmp

Download

memory/3968-250-0x00000150555F0000-0x0000015055600000-memory.dmp

Download

memory/3968-12-0x0000015055350000-0x0000015055360000-memory.dmp

Download

memory/3968-253-0x0000015055600000-0x0000015055610000-memory.dmp

Download

memory/3968-257-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-67-0x00000150554A0000-0x00000150554B0000-memory.dmp

Download

memory/3968-66-0x0000015055400000-0x0000015055410000-memory.dmp

Download

memory/3968-265-0x0000015055620000-0x0000015055630000-memory.dmp

Download

memory/3968-264-0x0000015055610000-0x0000015055620000-memory.dmp

Download

memory/3968-64-0x0000015055490000-0x00000150554A0000-memory.dmp

Download

memory/3968-278-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-63-0x00000150553F0000-0x0000015055400000-memory.dmp

Download

memory/3968-61-0x00000150553E0000-0x00000150553F0000-memory.dmp

Download

memory/3968-62-0x0000015055480000-0x0000015055490000-memory.dmp

Download

memory/3968-312-0x0000015055630000-0x0000015055640000-memory.dmp

Download

memory/3968-310-0x0000000070BC0000-0x0000000070C9C000-memory.dmp

Download

memory/3968-309-0x00000150538F0000-0x00000150538FC000-memory.dmp

Download

memory/3968-307-0x000001506FBB0000-0x000001506FC7D000-memory.dmp

Download

memory/3968-314-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-317-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-58-0x0000015055470000-0x0000015055480000-memory.dmp

Download

memory/3968-57-0x00000150553D0000-0x00000150553E0000-memory.dmp

Download

memory/3968-55-0x0000015055460000-0x0000015055470000-memory.dmp

Download

memory/3968-51-0x00000150553A0000-0x00000150553B0000-memory.dmp

Download

memory/3968-324-0x0000015055640000-0x0000015055650000-memory.dmp

Download

memory/3968-52-0x00000150553C0000-0x00000150553D0000-memory.dmp

Download

memory/3968-53-0x0000015055450000-0x0000015055460000-memory.dmp

Download

memory/3968-48-0x0000015055390000-0x00000150553A0000-memory.dmp

Download

memory/3968-16-0x0000015055360000-0x0000015055370000-memory.dmp

Download

memory/3968-49-0x0000015055440000-0x0000015055450000-memory.dmp

Download

memory/3968-44-0x0000015055380000-0x0000015055390000-memory.dmp

Download

memory/3968-342-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-45-0x0000015055430000-0x0000015055440000-memory.dmp

Download

memory/3968-17-0x0000015055370000-0x0000015055380000-memory.dmp

Download

memory/3968-41-0x0000015055360000-0x0000015055370000-memory.dmp

Download

memory/3968-42-0x0000015055420000-0x0000015055430000-memory.dmp

Download

memory/3968-43-0x0000015055410000-0x0000015055420000-memory.dmp

Download

memory/3968-38-0x0000015055400000-0x0000015055410000-memory.dmp

Download

memory/3968-35-0x00000150553F0000-0x0000015055400000-memory.dmp

Download

memory/3968-34-0x0000015055350000-0x0000015055360000-memory.dmp

Download

memory/3968-31-0x00000150553D0000-0x00000150553E0000-memory.dmp

Download

memory/3968-32-0x00000150553E0000-0x00000150553F0000-memory.dmp

Download

memory/3968-30-0x00000150550E0000-0x0000015055350000-memory.dmp

Download

memory/3968-18-0x0000015055380000-0x0000015055390000-memory.dmp

Download

memory/3968-28-0x0000015053870000-0x0000015053871000-memory.dmp

Download

memory/3968-20-0x0000015055390000-0x00000150553A0000-memory.dmp

Download

memory/3968-25-0x00000150553B0000-0x00000150553C0000-memory.dmp

Download

memory/3968-26-0x00000150553A0000-0x00000150553B0000-memory.dmp

Download

memory/3968-27-0x00000150553C0000-0x00000150553D0000-memory.dmp

Download

memory/4348-252-0x0000029641A40000-0x0000029641B0D000-memory.dmp

Download

memory/4416-361-0x0000028706A10000-0x0000028706ADD000-memory.dmp

Download

memory/4468-354-0x000001D705FF0000-0x000001D7060BD000-memory.dmp

Download

memory/4524-339-0x000001F9A6AB0000-0x000001F9A6B7D000-memory.dmp

Download

memory/4540-366-0x000001BD48470000-0x000001BD4853D000-memory.dmp

Download

memory/4884-344-0x000001F35E000000-0x000001F35E0CD000-memory.dmp

Download