Analysis
-
max time kernel
164s -
max time network
162s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
16-01-2025 11:54
Static task
static1
Behavioral task
behavioral1
Sample
Patch_MB_4.6.x.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
Patch_MB_4.6.x.exe
-
Size
65.2MB
-
MD5
3f44b49e3adca0e1a5f82553a72362c3
-
SHA1
0c1070cb840ad39150467df43456c8f39a2ba7a6
-
SHA256
139d053d79773b0a222c1217511f860e3bc1b6f82f0694fcd8be34417fa4d1c7
-
SHA512
7f33016a43e0dc786d4fb99ac3b6cb8453aebe5ecd926b2cf26cefc16e1e8902c91891493d58c526d0471b8900a865b0737c6e7e59f069450bbe38f04f4b653d
-
SSDEEP
1572864:SEsyRx4b2ot/G1+aGepsIq3gkJfDzkRl8fwAmpWnhEgo5BTEePUox7KQnx:SER4b2ot/c+3epxmJE38fwA7hE1jTEeL
Malware Config
Signatures
-
Drops file in Drivers directory 17 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File created C:\Windows\system32\DRIVERS\SETA1CE.tmp mbamservice.exe File created C:\Windows\system32\DRIVERS\SETCFE6.tmp mbamservice.exe File created C:\Windows\system32\drivers\is-PHBBS.tmp rs.tmp File created C:\Windows\system32\DRIVERS\MbamElam.sys mbamservice.exe File created C:\Windows\system32\DRIVERS\SETCF86.tmp mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys mbamservice.exe File created C:\Windows\system32\DRIVERS\SETCF96.tmp mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\mwac.sys mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\farflt.sys mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\SETA1CE.tmp mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\SETCF86.tmp mbamservice.exe File created C:\Windows\system32\DRIVERS\mbam.sys mbamservice.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\system32\DRIVERS\SETCF96.tmp mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\SETCFE6.tmp mbamservice.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" mbamservice.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbamservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbamservice.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation _iu14D2N.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 13 IoCs
pid Process 2568 7z2201.exe 1876 7z.exe 2684 7z.exe 4684 rs.exe 3740 rs.tmp 2144 mbamservice.exe 3992 mbamservice.exe 456 mbamtray.exe 4472 unins000.exe 1752 _iu14D2N.tmp 3300 MBAMWsc.exe 3612 mbamservice.exe 4496 mbamwsc.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService rs.tmp Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" rs.tmp -
Loads dropped DLL 62 IoCs
pid Process 1876 7z.exe 2684 7z.exe 3740 rs.tmp 3740 rs.tmp 3740 rs.tmp 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 1752 _iu14D2N.tmp 3688 regsvr32.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: mbamservice.exe File opened (read-only) \??\U: mbamservice.exe File opened (read-only) \??\Y: mbamservice.exe File opened (read-only) \??\B: mbamservice.exe File opened (read-only) \??\G: mbamservice.exe File opened (read-only) \??\L: mbamservice.exe File opened (read-only) \??\O: mbamservice.exe File opened (read-only) \??\W: mbamservice.exe File opened (read-only) \??\Z: mbamservice.exe File opened (read-only) \??\H: mbamservice.exe File opened (read-only) \??\M: mbamservice.exe File opened (read-only) \??\P: mbamservice.exe File opened (read-only) \??\R: mbamservice.exe File opened (read-only) \??\J: mbamservice.exe File opened (read-only) \??\K: mbamservice.exe File opened (read-only) \??\Q: mbamservice.exe File opened (read-only) \??\T: mbamservice.exe File opened (read-only) \??\V: mbamservice.exe File opened (read-only) \??\X: mbamservice.exe File opened (read-only) \??\A: mbamservice.exe File opened (read-only) \??\E: mbamservice.exe File opened (read-only) \??\I: mbamservice.exe File opened (read-only) \??\N: mbamservice.exe -
pid Process 4876 powershell.exe 348 powershell.exe 2084 powershell.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5 mbamservice.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt mbamservice.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt mbamservice.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9 mbamservice.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EE44ECA143B76F2B9F2A5AA75B5D1EC6_847118BE2683F0C241D1D702F3A3F5F9 mbamservice.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CA4458E7366E94A3C3A9C1FE548B6D21_C2C3D990B393462F0B24251F41DF0EF5 mbamservice.exe -
Enumerates processes with tasklist 1 TTPs 64 IoCs
pid Process 4868 tasklist.exe 3740 tasklist.exe 4032 tasklist.exe 3624 tasklist.exe 1648 tasklist.exe 2320 tasklist.exe 648 tasklist.exe 1480 tasklist.exe 1820 tasklist.exe 3036 Process not Found 556 tasklist.exe 408 tasklist.exe 656 tasklist.exe 1744 tasklist.exe 236 tasklist.exe 2188 tasklist.exe 2312 tasklist.exe 236 tasklist.exe 848 Process not Found 4004 Process not Found 3048 tasklist.exe 4712 tasklist.exe 3084 tasklist.exe 1616 Process not Found 2688 Process not Found 3360 Process not Found 1004 Process not Found 4560 Process not Found 8 tasklist.exe 1180 tasklist.exe 2952 tasklist.exe 4624 tasklist.exe 4272 tasklist.exe 380 tasklist.exe 1324 Process not Found 4156 tasklist.exe 760 Process not Found 3228 tasklist.exe 1732 tasklist.exe 1632 tasklist.exe 1616 Process not Found 1956 tasklist.exe 1148 tasklist.exe 3964 tasklist.exe 740 tasklist.exe 464 tasklist.exe 3648 Process not Found 4560 Process not Found 2224 tasklist.exe 4216 tasklist.exe 4592 Process not Found 3656 Process not Found 4484 tasklist.exe 3256 tasklist.exe 1224 tasklist.exe 2192 tasklist.exe 2068 Process not Found 2748 tasklist.exe 4916 tasklist.exe 824 tasklist.exe 3396 Process not Found 2044 tasklist.exe 4940 tasklist.exe 848 tasklist.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\7-Zip\Lang\sv.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-9OGQQ.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\de.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\ku.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-0VQCV.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-AGHQB.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-HQ485.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-VA22P.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\tt.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-I5PQO.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-L2R70.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-09VJP.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\mn.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\nn.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-F6PII.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-RH44F.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-FFFQD.tmp rs.tmp File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json mbamservice.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-FH82O.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\cy.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\gl.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\tr.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-6APM8.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\is-IBKNH.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-BGTEH.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-V1GOB.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\ta.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.inf mbamservice.exe File created C:\Program Files (x86)\7-Zip\Lang\kk.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\uk.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\7zFM.exe 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\is-E0R4S.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-D9KSV.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-EP7BG.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat mbamservice.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\co.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\he.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ka.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\is-1B8VN.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-P5FQQ.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-I05CK.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\be.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-7RTL2.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\bn.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\uk.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\is-NKJP8.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-SM6MN.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-8GEFJ.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-6KL43.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\mng.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-EB349.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\unins000.msg rs.tmp File created C:\Program Files (x86)\7-Zip\readme.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-BGLP0.tmp rs.tmp File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sdk\mbam.tmf mbamservice.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\is-VGR4F.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\History.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\ja.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-OSE8J.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf mbamservice.exe File created C:\Program Files (x86)\7-Zip\Lang\et.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\ast.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt 7z2201.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ELAMBKUP\MbamElam.sys mbamservice.exe File opened for modification C:\Windows\security\logs\scecomp.log mbamservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unins000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _iu14D2N.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z2201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rs.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbamtray.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mbamservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mbamservice.exe -
Delays execution with timeout.exe 19 IoCs
pid Process 4456 timeout.exe 4344 timeout.exe 2744 timeout.exe 4328 timeout.exe 3244 timeout.exe 756 timeout.exe 4868 timeout.exe 4004 timeout.exe 2380 timeout.exe 4220 timeout.exe 1904 timeout.exe 1104 timeout.exe 4896 timeout.exe 4968 timeout.exe 4676 timeout.exe 1704 timeout.exe 1992 timeout.exe 2312 timeout.exe 4632 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION rs.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" rs.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" rs.tmp -
Modifies data under HKEY_USERS 48 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs mbamservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mbamservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mbamservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mbamservice.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE35F2CA-6335-49BA-8E86-F6E246CFCEA6}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\0 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5250E5C8-A09C-4F87-A0DA-A46A62A0EACF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}\1.0\FLAGS\ = "0" mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\TypeLib\Version = "1.0" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC4D9C86-78F2-435F-8355-5328509E04F1}\ = "ITelemetryControllerV4" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\ = "_IArwControllerEventsV4" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{783B187E-360F-419C-B6DA-592892764A01}\1.0 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll" 7z2201.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0D8223D-D594-4147-BAD8-1E2B54ED1990}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC2F8F62-D471-4AD5-B346-9F214FE941A7} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\ = "ILinker" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\ProxyStubClsid32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A574BA8-3535-41F9-AB73-FA93F8A7DC3B}\TypeLib\Version = "1.0" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\TypeLib\Version = "1.0" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7196E77C-8EA5-4824-92C9-BAE8671149FA}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1BA0B73-14BD-4C9D-98CA-99355BD4EB24}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76} mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F77B440A-6CBC-4AFD-AA22-444552960E50}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65} mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F77B440A-6CBC-4AFD-AA22-444552960E50}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}\1.0\HELPDIR mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\ProxyStubClsid32 mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\TypeLib mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\ = "ILicenseControllerV6" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17A7CC72-3288-442A-ABE8-F8E049B3BE83}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\ = "IAEControllerV4" mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A23C190D-C714-42C7-BDBB-F4E1DE65AF27} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\ = "IPoliciesControllerV4" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFA1689-38D3-4AE9-B1E8-B039EB7AD988}\TypeLib\Version = "1.0" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E} mbamservice.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df020000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mbamtray.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a80300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc32000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a mbamtray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates mbamservice.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mbamtray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs mbamservice.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df0030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4740f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mbamtray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A mbamservice.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 mbamservice.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 mbamservice.exe Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\SPC mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs mbamservice.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a80300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a mbamtray.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc250f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a mbamtray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mbamtray.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 mbamtray.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 456 mbamtray.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe 348 powershell.exe 348 powershell.exe 348 powershell.exe 348 powershell.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 456 mbamtray.exe 456 mbamtray.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 3992 mbamservice.exe 2084 powershell.exe 2084 powershell.exe 2084 powershell.exe 2084 powershell.exe 2084 powershell.exe 2192 WMIC.exe 2192 WMIC.exe 2192 WMIC.exe 2192 WMIC.exe -
Suspicious behavior: LoadsDriver 8 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1876 7z.exe Token: 35 1876 7z.exe Token: SeSecurityPrivilege 1876 7z.exe Token: SeSecurityPrivilege 1876 7z.exe Token: SeRestorePrivilege 2684 7z.exe Token: 35 2684 7z.exe Token: SeSecurityPrivilege 2684 7z.exe Token: SeSecurityPrivilege 2684 7z.exe Token: SeDebugPrivilege 4876 powershell.exe Token: SeDebugPrivilege 348 powershell.exe Token: 33 2144 mbamservice.exe Token: SeIncBasePriorityPrivilege 2144 mbamservice.exe Token: 33 3992 mbamservice.exe Token: SeIncBasePriorityPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeTakeOwnershipPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeBackupPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeBackupPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeTakeOwnershipPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeBackupPrivilege 3992 mbamservice.exe Token: SeAssignPrimaryTokenPrivilege 3992 mbamservice.exe Token: SeIncreaseQuotaPrivilege 3992 mbamservice.exe Token: SeSecurityPrivilege 3992 mbamservice.exe Token: SeTakeOwnershipPrivilege 3992 mbamservice.exe Token: SeLoadDriverPrivilege 3992 mbamservice.exe Token: SeSystemtimePrivilege 3992 mbamservice.exe Token: SeBackupPrivilege 3992 mbamservice.exe Token: SeRestorePrivilege 3992 mbamservice.exe Token: SeShutdownPrivilege 3992 mbamservice.exe Token: SeSystemEnvironmentPrivilege 3992 mbamservice.exe Token: SeUndockPrivilege 3992 mbamservice.exe Token: SeManageVolumePrivilege 3992 mbamservice.exe Token: SeDebugPrivilege 2084 powershell.exe Token: SeSecurityPrivilege 3992 mbamservice.exe Token: SeSecurityPrivilege 3992 mbamservice.exe Token: 33 3612 mbamservice.exe Token: SeIncBasePriorityPrivilege 3612 mbamservice.exe Token: SeIncreaseQuotaPrivilege 2192 WMIC.exe Token: SeSecurityPrivilege 2192 WMIC.exe Token: SeTakeOwnershipPrivilege 2192 WMIC.exe Token: SeLoadDriverPrivilege 2192 WMIC.exe Token: SeSystemProfilePrivilege 2192 WMIC.exe Token: SeSystemtimePrivilege 2192 WMIC.exe Token: SeProfSingleProcessPrivilege 2192 WMIC.exe Token: SeIncBasePriorityPrivilege 2192 WMIC.exe Token: SeCreatePagefilePrivilege 2192 WMIC.exe Token: SeBackupPrivilege 2192 WMIC.exe Token: SeRestorePrivilege 2192 WMIC.exe Token: SeShutdownPrivilege 2192 WMIC.exe Token: SeDebugPrivilege 2192 WMIC.exe Token: SeSystemEnvironmentPrivilege 2192 WMIC.exe Token: SeRemoteShutdownPrivilege 2192 WMIC.exe Token: SeUndockPrivilege 2192 WMIC.exe Token: SeManageVolumePrivilege 2192 WMIC.exe Token: 33 2192 WMIC.exe Token: 34 2192 WMIC.exe Token: 35 2192 WMIC.exe Token: 36 2192 WMIC.exe Token: SeIncreaseQuotaPrivilege 2192 WMIC.exe Token: SeSecurityPrivilege 2192 WMIC.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3740 rs.tmp 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 1752 _iu14D2N.tmp -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe 456 mbamtray.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 3084 3408 Patch_MB_4.6.x.exe 81 PID 3408 wrote to memory of 3084 3408 Patch_MB_4.6.x.exe 81 PID 3084 wrote to memory of 2568 3084 cmd.exe 83 PID 3084 wrote to memory of 2568 3084 cmd.exe 83 PID 3084 wrote to memory of 2568 3084 cmd.exe 83 PID 3084 wrote to memory of 1752 3084 cmd.exe 84 PID 3084 wrote to memory of 1752 3084 cmd.exe 84 PID 3084 wrote to memory of 1208 3084 cmd.exe 85 PID 3084 wrote to memory of 1208 3084 cmd.exe 85 PID 1208 wrote to memory of 2148 1208 cmd.exe 86 PID 1208 wrote to memory of 2148 1208 cmd.exe 86 PID 3084 wrote to memory of 412 3084 cmd.exe 87 PID 3084 wrote to memory of 412 3084 cmd.exe 87 PID 412 wrote to memory of 2144 412 cmd.exe 88 PID 412 wrote to memory of 2144 412 cmd.exe 88 PID 3084 wrote to memory of 4228 3084 cmd.exe 89 PID 3084 wrote to memory of 4228 3084 cmd.exe 89 PID 3084 wrote to memory of 1876 3084 cmd.exe 91 PID 3084 wrote to memory of 1876 3084 cmd.exe 91 PID 3084 wrote to memory of 1876 3084 cmd.exe 91 PID 4228 wrote to memory of 4076 4228 cmd.exe 92 PID 4228 wrote to memory of 4076 4228 cmd.exe 92 PID 4228 wrote to memory of 4024 4228 cmd.exe 93 PID 4228 wrote to memory of 4024 4228 cmd.exe 93 PID 4228 wrote to memory of 3132 4228 cmd.exe 94 PID 4228 wrote to memory of 3132 4228 cmd.exe 94 PID 4228 wrote to memory of 1480 4228 cmd.exe 95 PID 4228 wrote to memory of 1480 4228 cmd.exe 95 PID 3084 wrote to memory of 2684 3084 cmd.exe 96 PID 3084 wrote to memory of 2684 3084 cmd.exe 96 PID 3084 wrote to memory of 2684 3084 cmd.exe 96 PID 4228 wrote to memory of 740 4228 cmd.exe 97 PID 4228 wrote to memory of 740 4228 cmd.exe 97 PID 740 wrote to memory of 2636 740 cmd.exe 98 PID 740 wrote to memory of 2636 740 cmd.exe 98 PID 740 wrote to memory of 3872 740 cmd.exe 99 PID 740 wrote to memory of 3872 740 cmd.exe 99 PID 4228 wrote to memory of 1904 4228 cmd.exe 100 PID 4228 wrote to memory of 1904 4228 cmd.exe 100 PID 3084 wrote to memory of 4876 3084 cmd.exe 101 PID 3084 wrote to memory of 4876 3084 cmd.exe 101 PID 3084 wrote to memory of 348 3084 cmd.exe 102 PID 3084 wrote to memory of 348 3084 cmd.exe 102 PID 348 wrote to memory of 4684 348 powershell.exe 103 PID 348 wrote to memory of 4684 348 powershell.exe 103 PID 348 wrote to memory of 4684 348 powershell.exe 103 PID 4684 wrote to memory of 3740 4684 rs.exe 104 PID 4684 wrote to memory of 3740 4684 rs.exe 104 PID 4684 wrote to memory of 3740 4684 rs.exe 104 PID 4228 wrote to memory of 4456 4228 cmd.exe 107 PID 4228 wrote to memory of 4456 4228 cmd.exe 107 PID 3740 wrote to memory of 1832 3740 rs.tmp 109 PID 3740 wrote to memory of 1832 3740 rs.tmp 109 PID 3740 wrote to memory of 1132 3740 rs.tmp 111 PID 3740 wrote to memory of 1132 3740 rs.tmp 111 PID 3740 wrote to memory of 2144 3740 rs.tmp 113 PID 3740 wrote to memory of 2144 3740 rs.tmp 113 PID 4228 wrote to memory of 1704 4228 cmd.exe 115 PID 4228 wrote to memory of 1704 4228 cmd.exe 115 PID 4228 wrote to memory of 756 4228 cmd.exe 117 PID 4228 wrote to memory of 756 4228 cmd.exe 117 PID 3992 wrote to memory of 456 3992 mbamservice.exe 118 PID 3992 wrote to memory of 456 3992 mbamservice.exe 118 PID 3992 wrote to memory of 456 3992 mbamservice.exe 118 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1752 attrib.exe 4488 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Patch_MB_4.6.x.exe"C:\Users\Admin\AppData\Local\Temp\Patch_MB_4.6.x.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\09JHL10M.bat" "C:\Users\Admin\AppData\Local\Temp\Patch_MB_4.6.x.exe""2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\qbE576949.41\7z2201.exe"C:\Users\Admin\AppData\Local\Temp\qbE576949.41\7z2201.exe" /S3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2568
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"3⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\findstr.exefindstr "keystone" "C:\Windows\System32\drivers\etc\hosts"4⤵PID:2148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"3⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\system32\findstr.exefindstr "holocron" "C:\Windows\System32\drivers\etc\hosts"4⤵PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"3⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\system32\mode.commode con:cols=86 lines=364⤵PID:4076
-
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:4024
-
-
C:\Windows\system32\mode.commode 70,44⤵PID:3132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul4⤵PID:1480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $H|cmd4⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"5⤵PID:2636
-
-
C:\Windows\system32\cmd.execmd5⤵PID:3872
-
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1904
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4456
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1704
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:756
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4344
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4868
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2312
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1104
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4896
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4004
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2380
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4968
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4220
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4632
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4328
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:4676
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:3244
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2744
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4552
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4300
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1152
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1868
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4536
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3616
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1064
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4496
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3440
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1164
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:788
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1232
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3776
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:772
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4048
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1608
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2852
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4612
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1900
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5116
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4812
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4272
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1628
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:848
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:8
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3660
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2252
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2708
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:408
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1832
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4628
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2952
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4344
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4648
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3572
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2152
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3612
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2260
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3324
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3988
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4708
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2748
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4880
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1456
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1732
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1252
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1904
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3964
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:704
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3724
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:64
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3908
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4908
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2188
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4768
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4664
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2212
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3588
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2016
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4884
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:412
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1748
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1020
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4424
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3408
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2788
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1664
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1340
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3696
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1728
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3936
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4908
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2188
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4768
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2676
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2772
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:392
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1612
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1164
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:788
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2128
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4868
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4880
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4424
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3408
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2788
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1664
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2564
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2868
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1400
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3048
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1704
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3076
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4324
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1208
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3824
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4540
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4768
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2676
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2772
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:852
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2152
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3612
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2260
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4484
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2672
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2084
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2504
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4488
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3812
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2404
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2956
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2568
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1104
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2176
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4968
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2784
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3124
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4328
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4704
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1000
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5048
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:456
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3208
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3020
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1672
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2696
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4952
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3800
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4884
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1128
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1748
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2892
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4652
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:772
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2312
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4456
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2852
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1292
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2356
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1664
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1004
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3696
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3936
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4656
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:8
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4148
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3488
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1308
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1832
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3256
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4752
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1468
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4972
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4884
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1128
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1748
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2892
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4652
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2956
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3996
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4492
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1324
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4968
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1844
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2928
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4776
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1628
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1444
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3464
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:656
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3488
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3924
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3824
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4712
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1192
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3356
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3548
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1868
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2016
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:556
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1064
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:412
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3988
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1020
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2060
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1864
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5104
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4888
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4424
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4048
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1456
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4080
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5116
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2380
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3320
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5096
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:228
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:712
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4272
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5008
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:8
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5076
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2252
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1808
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3008
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1308
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3208
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3292
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2392
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3256
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1152
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1416
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3356
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3816
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1752
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4980
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4724
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4532
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4708
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3668
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2404
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3084
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4004
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2552
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1904
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2564
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1844
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4528
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3088
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1728
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4908
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1704
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3016
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:908
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:456
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2188
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3116
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2292
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4768
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4940
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4952
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2808
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1064
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3940
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4104
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1584
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:876
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4976
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2956
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1616
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4080
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5116
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2380
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5096
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4800
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3048
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4028
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1988
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1808
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3008
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1308
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3208
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3292
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3772
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4536
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2808
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1064
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3940
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3180
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4524
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1608
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1732
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4896
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1380
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1736
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3964
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2348
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2624
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:848
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1000
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1780
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:408
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2316
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4300
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2292
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4768
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4952
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4156
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2000
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4532
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1300
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3540
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3804
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:4216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3668
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4948
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4888
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2956
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3820
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1608
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3084
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3036
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1132
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3536
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2348
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2624
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:644
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:776
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:4564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3096
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:5016
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1504
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3924
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3264
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:784
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4716
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4940
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:3572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3816
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:4860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:236
-
-
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE576949.41\ck.7z" -o"C:\ProgramData" -pdjfhghjdfkhfjdhdjfgsjdfhjsdgfgdfhfghfGHDfd -y3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE576949.41\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -phgjkhdfgGDFGDFgjdhidughdgfdhgrthgfhfg -y3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\rs.exe"C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\is-2BE98.tmp\rs.tmp"C:\Users\Admin\AppData\Local\Temp\is-2BE98.tmp\rs.tmp" /SL5="$601C2,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\certutil.exe"certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-BF9EH.tmp\BaltimoreCyberTrustRoot.crt"6⤵PID:1832
-
-
C:\Windows\system32\certutil.exe"certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-BF9EH.tmp\DigiCertEVRoot.crt"6⤵PID:1132
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service /Protected6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1992
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\ProgramData\tl"3⤵
- Views/modifies file attributes
PID:4488
-
-
C:\Windows\system32\xcopy.exexcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json" "C:\ProgramData\tl"3⤵PID:5104
-
-
C:\Windows\system32\xcopy.exexcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json" "C:\ProgramData\tl"3⤵PID:4424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe"C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /FIRSTPHASEWND=$A005E /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1752 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /unregserver6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe" /uninstall6⤵
- Executes dropped EXE
PID:4496
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll"6⤵
- Loads dropped DLL
PID:3688
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value3⤵PID:2760
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_LocalTime Get Day,Month,Year /value4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh3⤵PID:4756
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh4⤵PID:4948
-
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:323⤵PID:2404
-
-
C:\Windows\system32\reg.exereg Add "HKLM\SOFTWARE\Microsoft\Alu" /f /reg:323⤵PID:4452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"3⤵PID:4044
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"4⤵PID:4888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"3⤵PID:1456
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"4⤵PID:1096
-
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:456
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 1 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none2⤵
- Executes dropped EXE
PID:3300
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5a2cc0a771f7507d28d4ea0131695186a
SHA1e31043104a102b636374bef2a5f92c75ccc36fc1
SHA2562d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92
SHA5128a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d
-
Filesize
4.1MB
MD596bded4523bb423b51a6d8046a10132b
SHA166123f2e3c4b8d8802fdd8d27af86a6f1f5b2841
SHA2560d3aa8451da1894db98f492152005defe1947ea911446dd1112868f219f31244
SHA51245c7fd71b608e8019f6e7a00469f93745b5b731615cfae48518f12d9bd119b9cb53e88fcc97d5de5067f406140a8d7cdb32274eec0c7fde4addd8a1a697d89bc
-
Filesize
2.1MB
MD563df04ba26b4e485e7e6d9acd497dfd8
SHA141554bf4069a6e07cd2abe941b7496f5084ba286
SHA25667bbf76887027a8924ceff2d81f119a36283a882c2611c104f137d8375f10acb
SHA5122571a9ba4c4101622360bf3cf548cf97f78cd0a07013bae207e45b964a12d822447dd2a1da1f0208029f46b169afe729231374e87aa830f7910f81e3b12ba826
-
Filesize
2.1MB
MD55c6a18b45eef87554c20b35aebbaf095
SHA133ab693d6c217bcf41459bac12beaf74d2db4110
SHA256750aa87ad53c56300295639f1b1fb9ed70e6450c83c806e951948c7be2a86a99
SHA5127544c8ec1aef1896bdc061c1db3950069a8d18d1e876c2c8ce75f61e6f4d038cffcb594d757cfccd1a67311e4e4b8059146cef0ab6b862d0342910dc34201e5f
-
Filesize
5.4MB
MD51aa36b41e437501f20ba879d9c23ed3c
SHA10f8ec29c321e0c96fb3bd3d8c51945ce70199490
SHA25686f81665b233c7bb75ea5b986edcb486ce92faf38d670d63632eb23875b32b40
SHA5122db53b44c47daabf74229755cfa9621cee8bb397042a8b8dc7e0748b366f42ff866a9e97562e5dea012f3d1741debbd5152debaadefa5060eb9f32a4bc1507f9
-
Filesize
3.4MB
MD5447926609e3228ff943c3cde0ed1692d
SHA1adbe95d3682677fa6583892124574d0f14ef1bc7
SHA256a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944
SHA512a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f
-
Filesize
3.6MB
MD5907cd3b4605457a0fcc4c884fbb85c80
SHA16aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1
SHA2562a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d
SHA51287251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791
-
Filesize
2.1MB
MD57821333ce81660424940fee144ae859b
SHA10296ea96ff58b0bd21c8b3f73816e96ab3ccf6bd
SHA256804a146bc91474f9a87accd473802efc74441020beb4cd455ee0b316d0b86d47
SHA51223ce5e8c4aab068183e2ee45353e65ee5aa3a99d05926744c21ea0ac8fd29000523e6d04cec6b7be29245b13a1d6eca4b9cc7e47e9ececd7779cea3fa01936a4
-
Filesize
2.4MB
MD569d87ada8d240550d7469e5ce7c75369
SHA1bb3422b1dc462922b6a24eee46629b89a590d327
SHA256b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79
SHA512bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58
-
Filesize
4.3MB
MD580a36bcaa9d09595687ff51460676127
SHA1a00a6ad5ddcaffcfb74e3394e46960dfd5450a17
SHA25655e3fbf495de13c76b6a715cfb68f2175efd5d9d58776e3b2fa3faec7a1f648e
SHA5122142b166be03cc0c00a1aa39d1263c26deace2453470c3a2753279de594bea111325b2b933fc8a3f4e9b4fa6d101cd0ad44d3371d590440cba7af7e53513da7e
-
Filesize
3.3MB
MD5bba22e78c119bb5ebdb904ecb9558d7d
SHA13a40af6df28969622a7161e118bccb54e1a30544
SHA256e149a3ecc5b44b50fcd5a70b884a7715edc4ac0dae904add3d1cb3c2d93f1f6a
SHA512f4cb0728502cfa1665fa1625791d4f0129ddd0e8a2b6d2179af230d19417c56f0be627611ea36753f50cb56cef2feab6995528dcb82a89560280a824f3dfff0f
-
Filesize
2.2MB
MD5e1e0e1e5342cacb856beaf7f5791ce3c
SHA1bcaa9d08eb2ac153276bd0509c91a84a277a5a54
SHA2567c61bcded4713b4b156139833c0da0d1076a790a54218f6e3c7b51752cd6fa9e
SHA51281ef3efa37a9e76d2153bca2eef33715373556fd9057945410d198182736fd68b724510bd4458aaafab5497d78c696bb7a24f82fe3cddd7b27e24fe804eb550a
-
Filesize
4.0MB
MD555ef5563825fda3ab05cbee48bb5cc99
SHA1fcb57cb21714edfc7e59671e9b3a6d9842a988da
SHA2563417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5
SHA51273891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1
-
Filesize
3.5MB
MD5235404716813d5b32d26fd17aed9112b
SHA1c77d3fde646cc07c274cbc2318fd884a6c8a4f36
SHA256ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781
SHA5126aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb
-
Filesize
2.3MB
MD5439e2f41cc91de42214d5ca2ea69ecd1
SHA1538bbdb5d0b7e563dbe1b1938e676a64b829b9c0
SHA25694a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df
SHA5128b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04
-
Filesize
51B
MD5bf86796fe0fb92b34e5f1100d5eb3bb5
SHA1bc10ef8edff446a9aae29a70be7fdb380979f916
SHA2562fc07c3fc5e834495d3f76b3f4b6454c57e78eb928cdd343b863d8170f00ed67
SHA512ef0c5e7ad46e9dd5dbe3741595b5887b34b75eab30de27343b02e68f0430e8a8cc7c79791f3a0ac1871d362eef3bd34f9bd4ac54e77a95ad1d1f2e1c65a10cbe
-
Filesize
47B
MD5f87ee333fc7093fb0a7d0bf86acde081
SHA18e5634b4eaf7ad9201be8fb04fd3ed734d3c5a28
SHA256e5ef72fb7af61be42f9f833f5e532ff4128a26e73920832ca87c5f00164e74a7
SHA5128530fb2efaa8de0c7f2a102a44fd4a035fbe9a06040290820fe0480e8f9bea2295695cce253023b92ad8ac0f2fe9563a6a0cd10e423e1c2e1fa212146276533f
-
Filesize
1.2MB
MD5a65e53c974a4e61728ecb632339a0978
SHA127e6ec4f8e34b40f1e08503245700c182b918ce9
SHA256ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a
SHA512b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e
-
Filesize
329KB
MD562d2156e3ca8387964f7aa13dd1ccd5b
SHA1a5067e046ed9ea5512c94d1d17c394d6cf89ccca
SHA25659cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa
SHA512006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60
-
Filesize
256KB
MD509a3995806569a7d3fdb05e54ea815ac
SHA1f6ea0bd03ef8d01fe92a63c750586b86ccdf7253
SHA2569e8a6672431aa5b805091c3e08f89417b7ba9ab931a031f3ff9641efccc6ed3f
SHA5120d76fe4b70225bbb2bcbf6734ae0a238a9b5b93eb53c6ed5feee30674c5dab79deb0b222100cf27bb8a1035832c3be153e900fe6a6703829a133126a57a76144
-
Filesize
6.4MB
MD5327cb21b41ce523e2faba8e17ab24404
SHA16dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA256638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
SHA512f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
-
Filesize
9KB
MD5988b553a227f7f37f14abb060a320b6f
SHA1f8244956defa0241dca4a6d5e5ee159b5ff96ecf
SHA25642b5c504cfeb02e7d12526ff5398d6063f3e9b3661bc4fb2ce312c7c6213af84
SHA5124c080c853d9a9265ea80fab43cea78ed9230c7be7977f84bea98847792996a9434dc8cfeda96ab2f357eb86134cd81681c6b91215b3f61e89dc96fcdb15e4324
-
Filesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
Filesize
20KB
MD531e4ac0c3d3bac32082304bd43560760
SHA1ac98325151661fc73674bfde8f40d2322b6f6f86
SHA256228ca2a510bb8bbf0e0ab29455bb0961b82774ff74e664bb20a864758b8b0904
SHA5122cfbf89ffecb1a001b8cd4f61d02681cac5900ea3166825cbe77982cf5cec40dff1cd0e2c17d3fb73842273e083b60683baa94dbf995c65d42300c4741196a64
-
Filesize
607B
MD531944534e4fabe17c4f9ad39bd35e6dd
SHA15b90e65b0eb3d3bf0245fe8b2e0d42df85413d96
SHA256b76b663b04cbd001dffd5629f675ac68f29d5183b8ec5291e65034a992c51c83
SHA512881d6ce9159a699213d44013d35414e90b4a8cdca19214c65f6f2e7df4988e4788e7ac899ded21130438d9ca3ead9570774e3cc6372db0c174a4adc933861cc2
-
Filesize
8.4MB
MD50ef8c690deab2e93b2cff1aaa5302065
SHA1469b8673542ae6bdd6467d0a83123704ea6a0306
SHA2560dc6596eeda04c2f82bf232059aaf675d461d6302710a14fbf0b895ae44bac6e
SHA5123244b549381d7e9db957f1c06f2c2b81be0fdaf67e5c706f499d80819e016841e19cc55e252adef29e9b95007f8bd9ddb5bdae868bb98fac31e0ae5da1c87b6d
-
Filesize
268KB
MD5303f8c619d472c98754b369e582f8e17
SHA171b32fb7b9faa4747be0c98a41fc88466e981b08
SHA2561d5ec9dd832ea97b5984939605897749c786094460cbd731ac2c44712b65cf0c
SHA51272241900cccbac3c19193f54649ff9bd89537a29df29d859f1358457ec9976c4b2a5ce8362b3438c7ad7feb8fb3c47cee00dbddb6e408259f8d45d7d9f30dda1
-
Filesize
219KB
MD5e271a915b084d17c4b18c26f8eb62ec9
SHA128638ae1c1cc5b04fb0f13d7b91c32847c2ae8bd
SHA2561d498436bb314813551704a3e46570cb3216224d6dae5473598df0cec3c5577b
SHA51266edec305631440f8f8ae3b75eae8c165b5d8c86e7cb3ebb947e6517c6fca45c005f6f7f77adec6f2bd2e7e9c55dfeaedfc2f10c7187a64904062b2d124ed8fd
-
Filesize
195KB
MD5af6d573ff797ace9f62cf693a18ce8af
SHA1c947458393289e420762f005bc8d8a7e8c905f3c
SHA2560c7c976d097788650cdd4440a421fc5f80e6a3ab33445e7e8ac49bd0d999fea0
SHA5125284ce3a008b4d5504dc17c96510aa0df416c08a9b57206982fc2b1b190535c52975827fded4fce7f09160deb8edf7417be665656145b085b4ecae7c503e950c
-
Filesize
113KB
MD5792f29fb1d0efb9410b26601772e2ba6
SHA12cf7b518b3be82a9cc98b9d8d83256ae156c34db
SHA256aed5fd68add4ab2e602c3dbb7956b83f6b04be569ac8910781a07cd4ff1d9a3e
SHA51288e3c9863bbf2d104d893f66568b6c264a6d1131690c1caa22c68cecbcb4837d461144c831f3d9e824a3e882cb2485fbaca9cebca9edc1b319db6d278807c2a2
-
Filesize
53KB
MD5f1b3f84a3eca922e9e058aaa71454b2b
SHA1331a8dc33c1c56e2e7ad8a53f4ee253f8486b90a
SHA25686d548b35413a8a4fc2463786b0ca60fd603817f81fa470085dbca0887e33d52
SHA512cc3baeaef79b0169f7bdee742b08b47e9c4dae931968c1ac25df11e7d039223492cffd6e128a6e1b6c820fda07fa60af854b83a080263e273bf07e3e217e1dea
-
Filesize
69KB
MD514b938f4222a4e2ce59cbdcb67e920a7
SHA1724366357102bbce7a6e7d7d1a2066ff902de719
SHA2560fc061ca5acd55ff96d9e3170b5745d3cce7f555871adae771341ed025e177a7
SHA51248936de33c04efcd62bf470389afe5ca983fa841fe453050b0931d664238da2da5cea7a2019a87e7f68bf4f01e007941fe046b539c234fba41d58e09a5ead92e
-
Filesize
41KB
MD548053a47f0eb3e4c2e5432df5a74ff4e
SHA11838312f160af44806b4bd1bc66e0c29b17e2d7a
SHA25627c656f8d45198b08ab19439c98062e193e26f078bd3af6e0fb9dab214accbea
SHA512a4900ec71c8873a6105e627fa845d5f5e83679116b073ea1bf0189194f4b97f26bde2279ffd7703417a798bd13f5e911015efad7958982b11d49ccd48ac79e5e
-
Filesize
243B
MD5bcb25e25d190e9e4b8317bcbab16e5a9
SHA11c5a896d94f7169f6a3a621ad0787bb1fc339ab7
SHA256c9e6cd33c22cdba081201aeccbfe2997eb9a2b0ab6931068c8346e94520ed221
SHA5126313c5c0d5fc8edb517e6af78de62d673da22a36d03ea2aa8fe3929386992a5226d66be5968f07f54b41387ff47d97aab9b691ae06454f4585e70307f160a600
-
Filesize
10KB
MD558daa24269448fb8afe2408124080fda
SHA1c12e33c03dfa349a2f280bfafaecde1c89f7af5f
SHA256f465cf053a06d3325af713dafbd03901480058f70e7467fc4a2bbf020d8ecdee
SHA51256fa4373d4baa8cd01601cb7d439466db925b9014ad610c91ff83ec062bbcbce0f045d286fc998c2204832e0b60a60c4c515aca170bb727399269d3b5f7e701d
-
Filesize
10KB
MD526287af00db9f491d866bafc8ac60d61
SHA1f2c2e8feb4408880ffc7a0e0f88489af9503f202
SHA2563f09592dabdef8936d59c17dee3f8bb3b64f078feb8b04d17ae298824b68e854
SHA51280c21396fb5432f01143458b87b3628c6d9ab280f829f26d81054446892dd51e363bfc1568f04f6122ae8d3e62bd8d194259a5b234f55e72cd833d4bc29342e0
-
Filesize
1KB
MD55eeb1e467c2f1531271e6aa821d2737b
SHA1eddfe3e8fa1902ebea42e24e502bf8f98b6b631b
SHA25697a6f9494b264a9c233151c0b857e3bafa14714ee5841065b2e2497f847ab9bb
SHA51208fe27e78cf9b126e5a43c58fc44bbb13dccb3c7d6741a4fa76e22f4d507e6887bbf5fef12d3ab03591fb65c5d531e5378516d4fa05288b11ea23edbf1ebd184
-
Filesize
803B
MD53c04f8df1aebb6ce2b68db4d931e8a3f
SHA170d8e18ed9c620ba3acdec92bde6fef6af919ca8
SHA2567c36febe7d7fe9378563c0f9cef7af5d3a1d8da0f6496e41027011f49f5c365b
SHA5120862f31206b5d9f7e26bc95f3fd3b6b8b36d2019ba25f1c1dad48257a6ac87aff400c87650ec05c52b5c301202c4a6039cf093a350bba6dac542c46e8c540262
-
Filesize
645B
MD5503b5b3981ac0c140f2b696903b92a97
SHA172fc61f8de4666f365db8aed7ddff6a67b5cd1e9
SHA256a270b4e814701ac5c67426713148a5365abbd262ab75e398c3d91fc365825808
SHA512f228897dd9fa3089b73cd03f0e49c2333c864d70822715f0c1b6b29519b3ea329329ed079e9563b62add8dbbc820fbb114412673ce29380addad7c4abf64b880
-
Filesize
5KB
MD5fbf34b6591aeca18150c4893de4bcb99
SHA1ec195954cf211441509d7c029891846714a282e4
SHA256140b6a262a7349747c02eaccca75195eaf10a617896959cfa5038510d764623a
SHA512510780b74d7cb33d19e6a4952b625be8d114d8fa4c5b32710722c8e97339db61d994aae422af910f48eb81ec8d4e8aee66bd70a3a128c305d50eb72ca9158811
-
Filesize
3KB
MD57ce25939d052374d52dc294d730f5642
SHA10bd806b524350c08c8ec886bd2d1c6620706bc2e
SHA2563db731051dcc579f2bf43ca7d51dfa8755caff320e365d8aa7ff2de66e11468b
SHA512b8ae1b7ff8a52e75ca15f516d8d2d77ccb81a456c538890b571baa90e7f1cd7f179525fe13ae8e0c63740f2bcbf0a7ff93fd1f272b47aeaeba440f3e2a2a9259
-
Filesize
8KB
MD5bffd12b283a89d010071424d0521406a
SHA199277c8cb5c10f783ec60a14fbd4cf30213f4265
SHA256c1ad428a7f3640b3c454d384c31edaa93e0234bcb0a9accdf525c747efe57cfb
SHA51249c6c09db0140b8277fcdc6b28c67fea9d63f77f927fbb9bd9b52f6b183f5ef9da433f30a01d6107203ec2f4e0ca03ed581d18429de05c4cb4d12bf76c6c8db2
-
Filesize
1KB
MD565187b6cd8e54f0c278ffe066ab73466
SHA162e3a9247d1d1ce3f31194918e67c218b1b40f34
SHA2564d2af144f7601c2ce74f8979b67c2365ddf23e49e195f88ed66d63ca15839c79
SHA512e323799c2c719c6c2aa3476c15b90e12c6841b27ba66db83589377688605513ef69d0e64ac66358e7dfbab8b7ba489682e19e1824fa67dcd800b62b5ffda2089
-
Filesize
1KB
MD51c6017ef8d788ae1af13092ab52ffe82
SHA19e4f6a2fd93c562965fd0bb323c6bdbe15b0b45c
SHA25657986accc1d2abce7fa516ae54e4cfb153a534138a42ca24ff9b286cc4f7f6f3
SHA5129ca1a2fde1c4b9dbcfff13e2b77290fc30269011f76b355323e6678f3e0aa6e5c4693102f214bfbb9c21fccf9fabd926556e2651e1cdc6533a1a595b98396ee8
-
Filesize
1KB
MD5cde020469cde6c5712cad93269d83b78
SHA17d6f36946ede82684835bbeb8324b1c98f3def31
SHA256b977d6761d3db4358423eee4b8d0a5075cd55437d909d57b4d7861e9c78c17a7
SHA51296e21c118003fa4f42c04e508ec5000026ef09ea830df0f62a639fcac0f2870d242df4fcf7827ac828f061f3906f6eb7b2c4e1afdb39ed8f4fe8c939e73f8733
-
Filesize
338B
MD56393a2fcc3180468ec2cb92bc04ec474
SHA16b61226b50189b2be9b7a235ef0d2144834f8c6e
SHA256fcf573ce660ecb7100ab391d5135654149f7c87bc8b7473628951e5af57b3e28
SHA51297a9dbad711ec4667dab070400fa8949f3fd3bf10cc6f1b4cd71331d71be2d46a7e7c926d0947d06ea491717207d3083f945132f152474149537a24a6905e422
-
Filesize
2KB
MD5713ad359b75fe6d947468ec1825202b9
SHA119dcd19f18a2ad6deb581451aad724bd44a592a4
SHA25656572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
SHA5124df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
-
Filesize
1KB
MD51dd003ff444ad7f5510a7921c64c80f1
SHA11f25434b32ab742ecf38b69fb1d3800f7f7b0cf3
SHA25603502fe7eba8d8ea6783f561616e1ca0cfa8ab361db9ff36807da59b52233e4d
SHA5126c7fb7cec92f1b18a76c35c9287a2691fd9caa841d3ae6d3450d213b55bd339ae4db7e47d22cfc59a9e1fedfc409849f1967026c71ad8c2067dd66b6596b2d77
-
Filesize
65KB
MD5eb69b0e339e99e881add5c11525c51d4
SHA1ba950ee140b7947537f68a1e70729998315a9509
SHA256918a6b84b99ab4c3058a5a5c98d997a82a24bea2098826402c46b6703fb74075
SHA51223ce37b3056c159a0abc5f5d325c5a277b3d19c2edffe6f11374d761b6c944a650a9432f69ca28c4f230208fbf3396bd716798aa3d17fd34439e0a9ed8dfcaf5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
-
Filesize
1KB
MD5379a301592736712c9a60676c50cf19b
SHA1c103790503bf8c2ff3f119adee027ebb429b9d21
SHA256cc7400692bd90e1b5fc44e11c8dd7c788cbb462f52ea3f3decb579e4d51eb268
SHA512dec25a31f2930eb575a43e654c29f170c261c1c4516767c0e71cc172ad6ad115914fb58d9cd79f681ff3d7c6baa6b7c0d6de99de09d7582c9807ae436f15572f
-
Filesize
1KB
MD5d25e0f479b9601edf2c9c2dad7ba2706
SHA12f1d0001e47394f4c4deec9645c5f2df99f91a95
SHA25663ff360aafde5ff959fb9671ec27002f99cbfae4907b410046b6a1b0f51cba9e
SHA5123ba164dad3cadf1ea9f0c555695e4d39cba47612599f547d0d0d59014577995c0ddbff0ef6a5e436867454da02d500136b54c034c2223586271b26108b2cfb5e
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
7KB
MD54f8b110e37a818130310f0c34ec90dc5
SHA13bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1
SHA256db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3
SHA512d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b
-
Filesize
3.0MB
MD5b55493d2b5f93a41c51811448ccd6975
SHA1584dc786acbb05e09062b98a7d976c9da17aa3a4
SHA2562cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405
SHA512e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1
-
Filesize
1.2MB
MD5734e95cdbe04f53fe7c28eeaaaad7327
SHA1e49a4d750f83bc81d79f1c4c3f3648a817c7d3da
SHA2568c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43
SHA51216b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7
-
Filesize
3KB
MD5084bcec51e9e9fdfb7ede38cd3cc710d
SHA1e9cadf12b623c9723545ebed1fa2460a26d933c9
SHA256a96640695a7ea02a6a0fd70052c762a3d1d468e45be6de386bc5780681d9c7aa
SHA512d983cfa8d2ced4eaa2494c0386c0453c48fb288c232ec5610b960380b1cdb436341e868003714713991f23d926e4918f5db00fe314d08931375063917733b04d
-
Filesize
48B
MD5e0f152377eede12e858cd38b107e93cb
SHA18127d21a2d2f1b98c97cd279f941b4833c3d27fd
SHA2568bbc3156b9e1c6115ed1c60791ed31143456f884edbc93059ec2a6f242dc57de
SHA5121ee43f5b29d8d5da5544ddb31c589f9f1bdf843f8980757fb6473b72145255009534654a84f0a53ed86ae77b656a4cb4b11814facfe3b9d39cbecfc333b39d9d
-
Filesize
10KB
MD500e2c7393785482cb3b6a16e70f4616a
SHA134bfac7b30f76cec30f67c846622cd9f5376eeeb
SHA256099cdcdbd73d53b4e4df567b165036c0b9c651fc177ffb7658d51e592f77bd36
SHA512e28399f17fe70acc3e568d93dc1f2ac10238b2938284374068acd4808f43c06c25d475c2459ab866f263c9e045a684f0bb46612ae07ab0eafc06d591292d0755
-
Filesize
131KB
MD5c641ae70458b05cfb0fb04feaef7084a
SHA14fe4d58d3db0f7b3d8f9a99b35691f6a9b8bbf1a
SHA256e44cdb3f13ebc33a0111f82ad00a23384ee1c2622bfce2bf90c5a1f63d3a258e
SHA512b37074da4a23d66f16894e856b61cf0651e4fde52f075abad0ad0d90b2298f41509279f2bfd3e8510f33d636bf3ce68f0072c92bce9b0c5cdb996b8436108532
-
Filesize
131KB
MD5774fdde3ff43a9e6d0947acfb2f6b4a7
SHA1da8f22c6dac9671a1179e2b484d640d85ef969c5
SHA2561ee41c83f2e5c4f33c3235c2e8004b6707fc35d7146c1fca438e90e554a5fc24
SHA5125f922ae8dbf616aa0114d5701b6530b2ef59becdfc9fc9872934ff4c576371a73ace270f8094140419f5a7b79f08e1e8f84e8d48a6951d85da0aaf25a64c0746