b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/update.jar
Size 24.6MB
Sample260407-s8dpgahs5l
SHA256 b4a7989bbe6d62951b93a33515f6690dab161e226aaae820ee6d9b086836d433
MD5 71d8a02cb6d6f3f5cb071395572aa0b4
SHA1 6e247911839419f46f1a3a56f76a819305738fdd
SHA512 c180e850de921890dca7dc8b2bf9119a6c1c6b2d86fd959690f245d126767dd5c85431f7ca4c159088c17d5f16f933dbc2c2a170003ff0d76948373fcf49371b
SSDEEP 786432:KxH2T6eobChbL5VJSIGEjXYZaa7NUoPN4jP:UHh7bCNMIdOR+oqP
TLSH
T16B471212D856883FE583E27678829FE6F83953D5E14B912B07F00993F6829CE4B3275D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2160	java.exe
2160	java.exe

Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com
15	discord.com
1	discord.com
2	discord.com
3	discord.com
4	discord.com
5	discord.com
9	discord.com
10	discord.com
12	discord.com
7	discord.com
8	discord.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
3796	tasklist.exe
5936	tasklist.exe
1616	tasklist.exe
5252	tasklist.exe
4240	tasklist.exe
4016	tasklist.exe
2472	tasklist.exe
5724	tasklist.exe
1432	tasklist.exe
4884	tasklist.exe
2836	tasklist.exe
3888	tasklist.exe
1820	tasklist.exe
1876	tasklist.exe
5872	tasklist.exe
5280	tasklist.exe
5032	tasklist.exe
472	tasklist.exe
3132	tasklist.exe
5092	tasklist.exe
2684	tasklist.exe
3644	tasklist.exe
4476	tasklist.exe
5732	tasklist.exe
4948	tasklist.exe
1044	tasklist.exe
3224	tasklist.exe
4916	tasklist.exe
1492	tasklist.exe
4924	tasklist.exe
1036	tasklist.exe
6036	tasklist.exe
1832	tasklist.exe
1536	tasklist.exe
5392	tasklist.exe
6136	tasklist.exe
5568	tasklist.exe
1372	tasklist.exe
4052	tasklist.exe
5928	tasklist.exe
4896	tasklist.exe
672	tasklist.exe
676	tasklist.exe
3004	tasklist.exe
5316	tasklist.exe
6088	tasklist.exe
6024	tasklist.exe
440	tasklist.exe
5780	tasklist.exe
4720	tasklist.exe
5436	tasklist.exe
3912	tasklist.exe
3656	tasklist.exe
5284	tasklist.exe
1672	tasklist.exe
6116	tasklist.exe
3744	tasklist.exe
5500	tasklist.exe
5764	tasklist.exe
4064	tasklist.exe
3108	tasklist.exe
1856	tasklist.exe
1744	tasklist.exe
5864	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 46 IoCs

defense_evasion

pid	Process
1648	taskkill.exe
3520	taskkill.exe
4720	taskkill.exe
4040	taskkill.exe
1840	taskkill.exe
3812	taskkill.exe
2156	taskkill.exe
3888	taskkill.exe
1192	taskkill.exe
4792	taskkill.exe
5108	taskkill.exe
4476	taskkill.exe
3760	taskkill.exe
540	taskkill.exe
412	taskkill.exe
1804	taskkill.exe
5036	taskkill.exe
2704	taskkill.exe
1336	taskkill.exe
3892	taskkill.exe
2444	taskkill.exe
3192	taskkill.exe
4280	taskkill.exe
4664	taskkill.exe
3248	taskkill.exe
4788	taskkill.exe
3860	taskkill.exe
2988	taskkill.exe
4084	taskkill.exe
2472	taskkill.exe
1952	taskkill.exe
2736	taskkill.exe
3140	taskkill.exe
436	taskkill.exe
1272	taskkill.exe
1680	taskkill.exe
3216	taskkill.exe
608	taskkill.exe
3528	taskkill.exe
3320	taskkill.exe
4732	taskkill.exe
1796	taskkill.exe
3632	taskkill.exe
132	taskkill.exe
3784	taskkill.exe
3324	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3292	schtasks.exe
2512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2160	java.exe
2160	java.exe
2160	java.exe
2160	java.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1044	WMIC.exe
Token: SeSecurityPrivilege	1044	WMIC.exe
Token: SeTakeOwnershipPrivilege	1044	WMIC.exe
Token: SeLoadDriverPrivilege	1044	WMIC.exe
Token: SeSystemProfilePrivilege	1044	WMIC.exe
Token: SeSystemtimePrivilege	1044	WMIC.exe
Token: SeProfSingleProcessPrivilege	1044	WMIC.exe
Token: SeIncBasePriorityPrivilege	1044	WMIC.exe
Token: SeCreatePagefilePrivilege	1044	WMIC.exe
Token: SeBackupPrivilege	1044	WMIC.exe
Token: SeRestorePrivilege	1044	WMIC.exe
Token: SeShutdownPrivilege	1044	WMIC.exe
Token: SeDebugPrivilege	1044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1044	WMIC.exe
Token: SeRemoteShutdownPrivilege	1044	WMIC.exe
Token: SeUndockPrivilege	1044	WMIC.exe
Token: SeManageVolumePrivilege	1044	WMIC.exe
Token: 33	1044	WMIC.exe
Token: 34	1044	WMIC.exe
Token: 35	1044	WMIC.exe
Token: 36	1044	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1044	WMIC.exe
Token: SeSecurityPrivilege	1044	WMIC.exe
Token: SeTakeOwnershipPrivilege	1044	WMIC.exe
Token: SeLoadDriverPrivilege	1044	WMIC.exe
Token: SeSystemProfilePrivilege	1044	WMIC.exe
Token: SeSystemtimePrivilege	1044	WMIC.exe
Token: SeProfSingleProcessPrivilege	1044	WMIC.exe
Token: SeIncBasePriorityPrivilege	1044	WMIC.exe
Token: SeCreatePagefilePrivilege	1044	WMIC.exe
Token: SeBackupPrivilege	1044	WMIC.exe
Token: SeRestorePrivilege	1044	WMIC.exe
Token: SeShutdownPrivilege	1044	WMIC.exe
Token: SeDebugPrivilege	1044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1044	WMIC.exe
Token: SeRemoteShutdownPrivilege	1044	WMIC.exe
Token: SeUndockPrivilege	1044	WMIC.exe
Token: SeManageVolumePrivilege	1044	WMIC.exe
Token: 33	1044	WMIC.exe
Token: 34	1044	WMIC.exe
Token: 35	1044	WMIC.exe
Token: 36	1044	WMIC.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2724	WMIC.exe
Token: SeSecurityPrivilege	2724	WMIC.exe
Token: SeTakeOwnershipPrivilege	2724	WMIC.exe
Token: SeLoadDriverPrivilege	2724	WMIC.exe
Token: SeSystemProfilePrivilege	2724	WMIC.exe
Token: SeSystemtimePrivilege	2724	WMIC.exe
Token: SeProfSingleProcessPrivilege	2724	WMIC.exe
Token: SeIncBasePriorityPrivilege	2724	WMIC.exe
Token: SeCreatePagefilePrivilege	2724	WMIC.exe
Token: SeBackupPrivilege	2724	WMIC.exe
Token: SeRestorePrivilege	2724	WMIC.exe
Token: SeShutdownPrivilege	2724	WMIC.exe
Token: SeDebugPrivilege	2724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2724	WMIC.exe
Token: SeRemoteShutdownPrivilege	2724	WMIC.exe
Token: SeUndockPrivilege	2724	WMIC.exe
Token: SeManageVolumePrivilege	2724	WMIC.exe
Token: 33	2724	WMIC.exe
Token: 34	2724	WMIC.exe
Token: 35	2724	WMIC.exe
Token: 36	2724	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2160	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1044	2160	java.exe	80
PID 2160 wrote to memory of 3292	2160	java.exe	82
PID 2160 wrote to memory of 2512	2160	java.exe	85
PID 2160 wrote to memory of 1536	2160	java.exe	88
PID 2160 wrote to memory of 2724	2160	java.exe	90
PID 2160 wrote to memory of 5032	2160	java.exe	92
PID 2160 wrote to memory of 1184	2160	java.exe	94
PID 2160 wrote to memory of 3088	2160	java.exe	96
PID 2160 wrote to memory of 4204	2160	java.exe	98
PID 2160 wrote to memory of 2036	2160	java.exe	100
PID 2160 wrote to memory of 1192	2160	java.exe	102
PID 2160 wrote to memory of 3384	2160	java.exe	104
PID 2160 wrote to memory of 3748	2160	java.exe	106
PID 2160 wrote to memory of 2088	2160	java.exe	108
PID 2160 wrote to memory of 3468	2160	java.exe	110
PID 2160 wrote to memory of 3796	2160	java.exe	112
PID 2160 wrote to memory of 1796	2160	java.exe	114
PID 2160 wrote to memory of 4924	2160	java.exe	116
PID 2160 wrote to memory of 4308	2160	java.exe	118
PID 2160 wrote to memory of 1680	2160	java.exe	120
PID 2160 wrote to memory of 772	2160	java.exe	122
PID 2160 wrote to memory of 3760	2160	java.exe	124
PID 2160 wrote to memory of 2684	2160	java.exe	126
PID 2160 wrote to memory of 3632	2160	java.exe	128
PID 2160 wrote to memory of 132	2160	java.exe	130
PID 2160 wrote to memory of 3892	2160	java.exe	132
PID 2160 wrote to memory of 4820	2160	java.exe	134
PID 2160 wrote to memory of 5080	2160	java.exe	136
PID 2160 wrote to memory of 2704	2160	java.exe	138
PID 2160 wrote to memory of 656	2160	java.exe	140
PID 2160 wrote to memory of 3976	2160	java.exe	142
PID 2160 wrote to memory of 1648	2160	java.exe	144
PID 2160 wrote to memory of 1900	2160	java.exe	146
PID 2160 wrote to memory of 1876	2160	java.exe	148
PID 2160 wrote to memory of 2444	2160	java.exe	150
PID 2160 wrote to memory of 3888	2160	java.exe	152
PID 2160 wrote to memory of 5040	2160	java.exe	154
PID 2160 wrote to memory of 4356	2160	java.exe	156
PID 2160 wrote to memory of 3520	2160	java.exe	158
PID 2160 wrote to memory of 608	2160	java.exe	159
PID 2160 wrote to memory of 3192	2160	java.exe	160
PID 2160 wrote to memory of 4280	2160	java.exe	162
PID 2160 wrote to memory of 3216	2160	java.exe	165
PID 2160 wrote to memory of 540	2160	java.exe	168
PID 2160 wrote to memory of 1336	2160	java.exe	169
PID 2160 wrote to memory of 4664	2160	java.exe	170
PID 2160 wrote to memory of 412	2160	java.exe	171
PID 2160 wrote to memory of 3784	2160	java.exe	176
PID 2160 wrote to memory of 4720	2160	java.exe	177
PID 2160 wrote to memory of 1192	2160	java.exe	178
PID 2160 wrote to memory of 3248	2160	java.exe	182
PID 2160 wrote to memory of 5036	2160	java.exe	183
PID 2160 wrote to memory of 1804	2160	java.exe	186
PID 2160 wrote to memory of 4040	2160	java.exe	187
PID 2160 wrote to memory of 4792	2160	java.exe	189
PID 2160 wrote to memory of 3528	2160	java.exe	192
PID 2160 wrote to memory of 4788	2160	java.exe	194
PID 2160 wrote to memory of 1840	2160	java.exe	195
PID 2160 wrote to memory of 3812	2160	java.exe	198
PID 2160 wrote to memory of 5108	2160	java.exe	199
PID 2160 wrote to memory of 3320	2160	java.exe	200
PID 2160 wrote to memory of 2988	2160	java.exe	204
PID 2160 wrote to memory of 4084	2160	java.exe	206
PID 2160 wrote to memory of 4476	2160	java.exe	207

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\update.jar
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3292
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\java\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\update.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2512
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5032
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1184
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3088
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4204
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2036
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1192
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3384
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3748
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2088
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3468
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3796
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:1796
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  PID:1680
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:772
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3760
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2684
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM firefox.exe /T
  2⤵
  - Kills process with taskkill
  PID:3632
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM zen.exe /T
  2⤵
  - Kills process with taskkill
  PID:132
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  PID:3892
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5080
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:2704
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:656
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  PID:1648
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1900
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1876
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe /T
  2⤵
  - Kills process with taskkill
  PID:2444
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ůŰeRa eØe /T
  2⤵
  - Kills process with taskkill
  PID:3888
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5040
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4356
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  PID:3520
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  PID:608
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM brave.exe
  2⤵
  - Kills process with taskkill
  PID:3192
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŧũrefox.exe
  2⤵
  - Kills process with taskkill
  PID:4280
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM oŰera.exe
  2⤵
  - Kills process with taskkill
  PID:3216
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM kometa.exe
  2⤵
  - Kills process with taskkill
  PID:540
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ůŲBIPQÍ.exe
  2⤵
  - Kills process with taskkill
  PID:1336
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM centbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4664
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM 7star.exe
  2⤵
  - Kills process with taskkill
  PID:412
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM sputnik.exe
  2⤵
  - Kills process with taskkill
  PID:3784
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM vivaldi.exe
  2⤵
  - Kills process with taskkill
  PID:4720
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM epicprivacybrowser.exe
  2⤵
  - Kills process with taskkill
  PID:1192
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM uran.exe
  2⤵
  - Kills process with taskkill
  PID:3248
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM browser.exe
  2⤵
  - Kills process with taskkill
  PID:5036
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM iridium.exe
  2⤵
  - Kills process with taskkill
  PID:1804
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM šŭiGo.exe
  2⤵
  - Kills process with taskkill
  PID:4040
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŵorch.exe
  2⤵
  - Kills process with taskkill
  PID:4792
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM ŷaterfox.exe
  2⤵
  - Kills process with taskkill
  PID:3528
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM palemoon.exe
  2⤵
  - Kills process with taskkill
  PID:4788
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM librewolf.exe
  2⤵
  - Kills process with taskkill
  PID:1840
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM Ŵůr.exe
  2⤵
  - Kills process with taskkill
  PID:3812
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM chromium.exe
  2⤵
  - Kills process with taskkill
  PID:5108
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM maxthon.exe
  2⤵
  - Kills process with taskkill
  PID:3320
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM slimjet.exe
  2⤵
  - Kills process with taskkill
  PID:2988
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM dcbrowser.exe
  2⤵
  - Kills process with taskkill
  PID:4084
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM cŨedot.exe
  2⤵
  - Kills process with taskkill
  PID:4476
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM eŬeMeJtÓ.exe
  2⤵
  - Kills process with taskkill
  PID:2472
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM fenrir.exe
  2⤵
  - Kills process with taskkill
  PID:3860
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM catalina.exe
  2⤵
  - Kills process with taskkill
  PID:2736
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM cůoWoJ.exe
  2⤵
  - Kills process with taskkill
  PID:3324
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM liebao.exe
  2⤵
  - Kills process with taskkill
  PID:2156
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM qipsurf.exe
  2⤵
  - Kills process with taskkill
  PID:1952
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM 360browser.exe
  2⤵
  - Kills process with taskkill
  PID:4732
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM comodo.exe
  2⤵
  - Kills process with taskkill
  PID:436
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM qip.exe
  2⤵
  - Kills process with taskkill
  PID:3140
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM sleipnir.exe
  2⤵
  - Kills process with taskkill
  PID:1272
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5604
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5736
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5800
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5864
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6008
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6076
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6140
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:232
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3780
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2428
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5392
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4472
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1672
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1248
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3288
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5472
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5500
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2152
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1676
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4252
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5252
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3644
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1592
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3656
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:324
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5284
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5560
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5648
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5716
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5772
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5896
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:6004
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6044
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6116
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2496
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1044
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:448
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3224
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4972
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:236
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5056
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4240
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5468
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4896
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4916
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2308
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5128
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5028
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2828
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5216
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3744
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4476
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5500
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2008
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5344
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3560
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1764
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4064
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2920
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5516
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5680
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5780
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5844
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5936
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5968
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6036
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6028
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6136
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1620
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5264
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2236
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4668
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3160
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:720
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5452
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3004
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4324
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5092
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3244
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:472
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2184
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4612
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5236
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2704
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4720
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5800
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4652
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3792
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5436
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5424
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2864
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4844
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2476
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4292
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5568
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5664
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5732
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5876
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5764
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5124
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1984
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:780
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:672
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3956
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4016
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3100
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1040
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4004
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3132
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5504
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4100
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5084
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1372
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4000
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2964
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3892
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4196
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3948
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2472
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2392
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5316
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5212
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4500
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4120
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3332
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4224
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1492
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5552
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5724
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5676
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5872
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1592
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5956
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4064
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5952
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2236
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5992
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4480
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5928
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6104
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3108
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4924
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4348
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3152
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3268
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:712
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1856
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3136
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1744
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5240
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3528
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5864
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6140
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1432
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2248
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1036
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1852
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1496
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5372
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5588
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1208
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5612
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5756
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5560
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:236
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5216
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2920
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3244
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2864
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6088
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6124
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5340
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3660
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1616
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2060
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5408
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3260
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2112
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3228
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4392
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4816
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4536
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5152
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3912
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3572
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3856
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2924
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5392
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3684
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4052
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4104
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2168
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5232
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4884
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:4948
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5768
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5252
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5648
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5468
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5452
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4672
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1668
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3036
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:2836
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4304
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:492
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:244
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4964
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:2436
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3088
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4700
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:3888
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5324
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3320
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6008
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5940
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1684
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2764
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3456
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5428
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1832
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1440
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5712
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5684
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5656
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5804
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:6024
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4720
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1432
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3244
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4004
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:5708
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5928
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:2184
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:6080
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:676
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:3204
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1796
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:4656
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:1380
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:1220
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3928
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:1820
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:3632
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5320
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:240
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:440
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:436
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  PID:5020
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
  2⤵
  PID:4236
- C:\Windows\SYSTEM32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna9010037268765992241.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9010037268765992241.dll
Size 248KB
SHA256 13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03
MD5 34d12b1e2af72d9bb267bbc8c0d53e4a
SHA1 d9ed8776645f6b4f52df16132450863c47ea92d7
SHA512 c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10
SSDEEP 6144:9RW+uZb5K8Dy+Zkt9dHlJ1ybBEleb906aslm/mFyygW:9RW+MbMOEe3Z
TLSH
T13C440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite-3.36.0.3-9a610793-063a-4ef2-927c-51420ebdd030-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.36.0.3-9a610793-063a-4ef2-927c-51420ebdd030-sqlitejdbc.dll
Size 847KB
SHA256 b0c53ebfcddc4031daad36aac9a2967921703431deba5e51234da5008ae45b2a
MD5 71eb6b5dbae2f9266a876be1af8dc00c
SHA1 364b79fe0a21c9f9827b298d187b493f5f14ce71
SHA512 0a27205fcc33f482f59aea22de02ba3a9a1981bd28adee97ba3702026f27c760350f5df34e5982f763b608867892d5d4cebb1e13efb159fc3eef431772e37b12
SSDEEP 24576:wYv4BPSYNRINkY0H2KY7v1ksjTuMtHFCIS:SBPjNSutE7DdFC
TLSH
T13F056C13E3A255FCC97FC2718B5AE723B971F4591234FA1EA5A48B203E10E60971FB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-2-0x0000029A80000000-0x0000029A80270000-memory.dmp

Download

memory/2160-12-0x0000029A80270000-0x0000029A80280000-memory.dmp

Download

memory/2160-17-0x0000029A80290000-0x0000029A802A0000-memory.dmp

Download

memory/2160-16-0x0000029A80280000-0x0000029A80290000-memory.dmp

Download

memory/2160-18-0x0000029A802A0000-0x0000029A802B0000-memory.dmp

Download

memory/2160-22-0x0000029A802C0000-0x0000029A802D0000-memory.dmp

Download

memory/2160-20-0x0000029A802B0000-0x0000029A802C0000-memory.dmp

Download

memory/2160-24-0x0000029A802D0000-0x0000029A802E0000-memory.dmp

Download

memory/2160-26-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-28-0x0000029A802E0000-0x0000029A802F0000-memory.dmp

Download

memory/2160-33-0x0000029A80300000-0x0000029A80310000-memory.dmp

Download

memory/2160-32-0x0000029A802F0000-0x0000029A80300000-memory.dmp

Download

memory/2160-31-0x0000029A80000000-0x0000029A80270000-memory.dmp

Download

memory/2160-39-0x0000029A80280000-0x0000029A80290000-memory.dmp

Download

memory/2160-38-0x0000029A80320000-0x0000029A80330000-memory.dmp

Download

memory/2160-37-0x0000029A80310000-0x0000029A80320000-memory.dmp

Download

memory/2160-36-0x0000029A80270000-0x0000029A80280000-memory.dmp

Download

memory/2160-40-0x0000029A80330000-0x0000029A80340000-memory.dmp

Download

memory/2160-45-0x0000029A80340000-0x0000029A80350000-memory.dmp

Download

memory/2160-44-0x0000029A802B0000-0x0000029A802C0000-memory.dmp

Download

memory/2160-43-0x0000029A802A0000-0x0000029A802B0000-memory.dmp

Download

memory/2160-48-0x0000029A80350000-0x0000029A80360000-memory.dmp

Download

memory/2160-50-0x0000029A80360000-0x0000029A80370000-memory.dmp

Download

memory/2160-49-0x0000029A802C0000-0x0000029A802D0000-memory.dmp

Download

memory/2160-52-0x0000029A802D0000-0x0000029A802E0000-memory.dmp

Download

memory/2160-53-0x0000029A80370000-0x0000029A80380000-memory.dmp

Download

memory/2160-55-0x0000029A802E0000-0x0000029A802F0000-memory.dmp

Download

memory/2160-56-0x0000029A80380000-0x0000029A80390000-memory.dmp

Download

memory/2160-59-0x0000029A80390000-0x0000029A803A0000-memory.dmp

Download

memory/2160-58-0x0000029A80300000-0x0000029A80310000-memory.dmp

Download

memory/2160-61-0x0000029A803A0000-0x0000029A803B0000-memory.dmp

Download

memory/2160-64-0x0000029A803B0000-0x0000029A803C0000-memory.dmp

Download

memory/2160-63-0x0000029A80310000-0x0000029A80320000-memory.dmp

Download

memory/2160-66-0x0000029A803C0000-0x0000029A803D0000-memory.dmp

Download

memory/2160-72-0x0000029A80340000-0x0000029A80350000-memory.dmp

Download

memory/2160-70-0x0000029A803D0000-0x0000029A803E0000-memory.dmp

Download

memory/2160-69-0x0000029A80330000-0x0000029A80340000-memory.dmp

Download

memory/2160-71-0x0000029A803E0000-0x0000029A803F0000-memory.dmp

Download

memory/2160-75-0x0000029A803F0000-0x0000029A80400000-memory.dmp

Download

memory/2160-74-0x0000029A80350000-0x0000029A80360000-memory.dmp

Download

memory/2160-78-0x0000029A80400000-0x0000029A80410000-memory.dmp

Download

memory/2160-77-0x0000029A80360000-0x0000029A80370000-memory.dmp

Download

memory/2160-80-0x0000029A80370000-0x0000029A80380000-memory.dmp

Download

memory/2160-81-0x0000029A80410000-0x0000029A80420000-memory.dmp

Download

memory/2160-83-0x0000029A80380000-0x0000029A80390000-memory.dmp

Download

memory/2160-84-0x0000029A80420000-0x0000029A80430000-memory.dmp

Download

memory/2160-87-0x0000029A80430000-0x0000029A80440000-memory.dmp

Download

memory/2160-86-0x0000029A80390000-0x0000029A803A0000-memory.dmp

Download

memory/2160-90-0x0000029A80440000-0x0000029A80450000-memory.dmp

Download

memory/2160-89-0x0000029A803A0000-0x0000029A803B0000-memory.dmp

Download

memory/2160-92-0x0000029A803B0000-0x0000029A803C0000-memory.dmp

Download

memory/2160-93-0x0000029A80450000-0x0000029A80460000-memory.dmp

Download

memory/2160-96-0x0000029A80460000-0x0000029A80470000-memory.dmp

Download

memory/2160-95-0x0000029A803C0000-0x0000029A803D0000-memory.dmp

Download

memory/2160-100-0x0000029A80470000-0x0000029A80480000-memory.dmp

Download

memory/2160-99-0x0000029A803E0000-0x0000029A803F0000-memory.dmp

Download

memory/2160-98-0x0000029A803D0000-0x0000029A803E0000-memory.dmp

Download

memory/2160-103-0x0000029A80480000-0x0000029A80490000-memory.dmp

Download

memory/2160-107-0x0000029A804A0000-0x0000029A804B0000-memory.dmp

Download

memory/2160-108-0x0000029A80400000-0x0000029A80410000-memory.dmp

Download

memory/2160-106-0x0000029A80490000-0x0000029A804A0000-memory.dmp

Download

memory/2160-105-0x0000029A803F0000-0x0000029A80400000-memory.dmp

Download

memory/2160-110-0x0000029A80410000-0x0000029A80420000-memory.dmp

Download

memory/2160-111-0x0000029A804B0000-0x0000029A804C0000-memory.dmp

Download

memory/2160-114-0x0000029A804C0000-0x0000029A804D0000-memory.dmp

Download

memory/2160-113-0x0000029A80420000-0x0000029A80430000-memory.dmp

Download

memory/2160-116-0x0000029A80430000-0x0000029A80440000-memory.dmp

Download

memory/2160-117-0x0000029A804D0000-0x0000029A804E0000-memory.dmp

Download

memory/2160-120-0x0000029A804E0000-0x0000029A804F0000-memory.dmp

Download

memory/2160-119-0x0000029A80440000-0x0000029A80450000-memory.dmp

Download

memory/2160-122-0x0000029A80450000-0x0000029A80460000-memory.dmp

Download

memory/2160-123-0x0000029A804F0000-0x0000029A80500000-memory.dmp

Download

memory/2160-125-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-128-0x0000029A80500000-0x0000029A80510000-memory.dmp

Download

memory/2160-127-0x0000029A80460000-0x0000029A80470000-memory.dmp

Download

memory/2160-132-0x0000029A80470000-0x0000029A80480000-memory.dmp

Download

memory/2160-133-0x0000029A80510000-0x0000029A80520000-memory.dmp

Download

memory/2160-137-0x0000029A80520000-0x0000029A80530000-memory.dmp

Download

memory/2160-136-0x0000029A80480000-0x0000029A80490000-memory.dmp

Download

memory/2160-140-0x0000029A80530000-0x0000029A80540000-memory.dmp

Download

memory/2160-139-0x0000029A804A0000-0x0000029A804B0000-memory.dmp

Download

memory/2160-138-0x0000029A80490000-0x0000029A804A0000-memory.dmp

Download

memory/2160-143-0x0000029A80540000-0x0000029A80550000-memory.dmp

Download

memory/2160-147-0x0000029A80550000-0x0000029A80560000-memory.dmp

Download

memory/2160-146-0x0000029A804B0000-0x0000029A804C0000-memory.dmp

Download

memory/2160-154-0x0000029A80560000-0x0000029A80570000-memory.dmp

Download

memory/2160-153-0x0000029A804C0000-0x0000029A804D0000-memory.dmp

Download

memory/2160-160-0x0000029A80570000-0x0000029A80580000-memory.dmp

Download

memory/2160-159-0x0000029A804D0000-0x0000029A804E0000-memory.dmp

Download

memory/2160-186-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-205-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-209-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-211-0x0000029A804E0000-0x0000029A804F0000-memory.dmp

Download

memory/2160-215-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-216-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-218-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-225-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-224-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-223-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-220-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-229-0x0000029A804F0000-0x0000029A80500000-memory.dmp

Download

memory/2160-230-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-232-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-233-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-236-0x0000029A80500000-0x0000029A80510000-memory.dmp

Download

memory/2160-239-0x0000029A80510000-0x0000029A80520000-memory.dmp

Download

memory/2160-241-0x0000029A80520000-0x0000029A80530000-memory.dmp

Download

memory/2160-246-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-248-0x0000029A80530000-0x0000029A80540000-memory.dmp

Download

memory/2160-252-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-253-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-254-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-257-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-259-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-281-0x0000029AF6040000-0x0000029AF6048000-memory.dmp

Download

memory/2160-285-0x0000029A80540000-0x0000029A80550000-memory.dmp

Download

memory/2160-284-0x0000000070BC0000-0x0000000070C9C000-memory.dmp

Download

memory/2160-283-0x0000029AF60E0000-0x0000029AF60EC000-memory.dmp

Download

memory/2160-282-0x0000029AFA7C0000-0x0000029AFA8AA000-memory.dmp

Download

memory/2160-302-0x0000029A80550000-0x0000029A80560000-memory.dmp

Download

memory/2160-304-0x0000029A80560000-0x0000029A80570000-memory.dmp

Download

memory/2160-322-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-327-0x0000000070BC0000-0x0000000070C9C000-memory.dmp

Download

memory/2160-331-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-335-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-338-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-343-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-345-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-346-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-348-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-405-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-411-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-415-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-435-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-447-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-451-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-494-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download

memory/2160-499-0x0000029AF6060000-0x0000029AF6061000-memory.dmp

Download