Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
06-08-2020 07:53
Static task
static1
Behavioral task
behavioral1
Sample
REN42159.jar
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
REN42159.jar
Resource
win10v200722
0 signatures
0 seconds
General
-
Target
REN42159.jar
-
Size
401KB
-
MD5
dc91a54b2286a05af54711ba5139a897
-
SHA1
ef36e7172287d286e7465442209d23d0d14ebf2e
-
SHA256
ddc0264f82a81e5c3070a77887e7840f0fbde2949b742b74381fe8ec39daa9b8
-
SHA512
a46142c6df8d614db6a0225d73dd72d73fd64e0a89b43f7d5da10d552f70c2f9d4aa9854e1ee68214c2c7f70d890374bf2853fbfcc39ecabef30c2fe71a10037
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\TFroSeoInu2361994479675576130.xml qarallax_dll -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 3488 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WKBnewJ = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\tHFwB\\YIYZS.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\WKBnewJ = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\tHFwB\\YIYZS.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
java.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\tHFwB\Desktop.ini java.exe File created C:\Users\Admin\tHFwB\Desktop.ini java.exe File opened for modification C:\Users\Admin\tHFwB\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\tHFwB\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
Processes:
java.exedescription ioc process File created C:\Windows\System32\pJjAo java.exe File opened for modification C:\Windows\System32\pJjAo java.exe -
Kills process with taskkill 17 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4996 taskkill.exe 3892 taskkill.exe 5300 taskkill.exe 5424 taskkill.exe 4676 taskkill.exe 4228 taskkill.exe 4436 taskkill.exe 1156 taskkill.exe 4496 taskkill.exe 5236 taskkill.exe 5364 taskkill.exe 4356 taskkill.exe 2784 taskkill.exe 1316 taskkill.exe 4768 taskkill.exe 5172 taskkill.exe 5484 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepid process 3020 powershell.exe 3020 powershell.exe 3020 powershell.exe 3020 powershell.exe -
Suspicious use of AdjustPrivilegeToken 123 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2648 WMIC.exe Token: SeSecurityPrivilege 2648 WMIC.exe Token: SeTakeOwnershipPrivilege 2648 WMIC.exe Token: SeLoadDriverPrivilege 2648 WMIC.exe Token: SeSystemProfilePrivilege 2648 WMIC.exe Token: SeSystemtimePrivilege 2648 WMIC.exe Token: SeProfSingleProcessPrivilege 2648 WMIC.exe Token: SeIncBasePriorityPrivilege 2648 WMIC.exe Token: SeCreatePagefilePrivilege 2648 WMIC.exe Token: SeBackupPrivilege 2648 WMIC.exe Token: SeRestorePrivilege 2648 WMIC.exe Token: SeShutdownPrivilege 2648 WMIC.exe Token: SeDebugPrivilege 2648 WMIC.exe Token: SeSystemEnvironmentPrivilege 2648 WMIC.exe Token: SeRemoteShutdownPrivilege 2648 WMIC.exe Token: SeUndockPrivilege 2648 WMIC.exe Token: SeManageVolumePrivilege 2648 WMIC.exe Token: 33 2648 WMIC.exe Token: 34 2648 WMIC.exe Token: 35 2648 WMIC.exe Token: 36 2648 WMIC.exe Token: SeIncreaseQuotaPrivilege 2648 WMIC.exe Token: SeSecurityPrivilege 2648 WMIC.exe Token: SeTakeOwnershipPrivilege 2648 WMIC.exe Token: SeLoadDriverPrivilege 2648 WMIC.exe Token: SeSystemProfilePrivilege 2648 WMIC.exe Token: SeSystemtimePrivilege 2648 WMIC.exe Token: SeProfSingleProcessPrivilege 2648 WMIC.exe Token: SeIncBasePriorityPrivilege 2648 WMIC.exe Token: SeCreatePagefilePrivilege 2648 WMIC.exe Token: SeBackupPrivilege 2648 WMIC.exe Token: SeRestorePrivilege 2648 WMIC.exe Token: SeShutdownPrivilege 2648 WMIC.exe Token: SeDebugPrivilege 2648 WMIC.exe Token: SeSystemEnvironmentPrivilege 2648 WMIC.exe Token: SeRemoteShutdownPrivilege 2648 WMIC.exe Token: SeUndockPrivilege 2648 WMIC.exe Token: SeManageVolumePrivilege 2648 WMIC.exe Token: 33 2648 WMIC.exe Token: 34 2648 WMIC.exe Token: 35 2648 WMIC.exe Token: 36 2648 WMIC.exe Token: SeIncreaseQuotaPrivilege 3596 WMIC.exe Token: SeSecurityPrivilege 3596 WMIC.exe Token: SeTakeOwnershipPrivilege 3596 WMIC.exe Token: SeLoadDriverPrivilege 3596 WMIC.exe Token: SeSystemProfilePrivilege 3596 WMIC.exe Token: SeSystemtimePrivilege 3596 WMIC.exe Token: SeProfSingleProcessPrivilege 3596 WMIC.exe Token: SeIncBasePriorityPrivilege 3596 WMIC.exe Token: SeCreatePagefilePrivilege 3596 WMIC.exe Token: SeBackupPrivilege 3596 WMIC.exe Token: SeRestorePrivilege 3596 WMIC.exe Token: SeShutdownPrivilege 3596 WMIC.exe Token: SeDebugPrivilege 3596 WMIC.exe Token: SeSystemEnvironmentPrivilege 3596 WMIC.exe Token: SeRemoteShutdownPrivilege 3596 WMIC.exe Token: SeUndockPrivilege 3596 WMIC.exe Token: SeManageVolumePrivilege 3596 WMIC.exe Token: 33 3596 WMIC.exe Token: 34 3596 WMIC.exe Token: 35 3596 WMIC.exe Token: 36 3596 WMIC.exe Token: SeIncreaseQuotaPrivilege 3596 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 3488 java.exe -
Suspicious use of WriteProcessMemory 398 IoCs
Processes:
java.execmd.execmd.execmd.exedescription pid process target process PID 3488 wrote to memory of 1652 3488 java.exe cmd.exe PID 3488 wrote to memory of 1652 3488 java.exe cmd.exe PID 3488 wrote to memory of 2324 3488 java.exe cmd.exe PID 3488 wrote to memory of 2324 3488 java.exe cmd.exe PID 2324 wrote to memory of 2648 2324 cmd.exe WMIC.exe PID 2324 wrote to memory of 2648 2324 cmd.exe WMIC.exe PID 3488 wrote to memory of 2696 3488 java.exe cmd.exe PID 3488 wrote to memory of 2696 3488 java.exe cmd.exe PID 2696 wrote to memory of 3596 2696 cmd.exe WMIC.exe PID 2696 wrote to memory of 3596 2696 cmd.exe WMIC.exe PID 3488 wrote to memory of 3712 3488 java.exe attrib.exe PID 3488 wrote to memory of 3712 3488 java.exe attrib.exe PID 3488 wrote to memory of 3576 3488 java.exe attrib.exe PID 3488 wrote to memory of 3576 3488 java.exe attrib.exe PID 3488 wrote to memory of 3688 3488 java.exe attrib.exe PID 3488 wrote to memory of 3688 3488 java.exe attrib.exe PID 3488 wrote to memory of 2064 3488 java.exe attrib.exe PID 3488 wrote to memory of 2064 3488 java.exe attrib.exe PID 3488 wrote to memory of 3784 3488 java.exe attrib.exe PID 3488 wrote to memory of 3784 3488 java.exe attrib.exe PID 3488 wrote to memory of 852 3488 java.exe attrib.exe PID 3488 wrote to memory of 852 3488 java.exe attrib.exe PID 3488 wrote to memory of 812 3488 java.exe attrib.exe PID 3488 wrote to memory of 812 3488 java.exe attrib.exe PID 3488 wrote to memory of 1128 3488 java.exe attrib.exe PID 3488 wrote to memory of 1128 3488 java.exe attrib.exe PID 3488 wrote to memory of 2116 3488 java.exe cmd.exe PID 3488 wrote to memory of 2116 3488 java.exe cmd.exe PID 3488 wrote to memory of 3020 3488 java.exe powershell.exe PID 3488 wrote to memory of 3020 3488 java.exe powershell.exe PID 3488 wrote to memory of 4048 3488 java.exe reg.exe PID 3488 wrote to memory of 4048 3488 java.exe reg.exe PID 3488 wrote to memory of 3880 3488 java.exe reg.exe PID 3488 wrote to memory of 3880 3488 java.exe reg.exe PID 3488 wrote to memory of 1432 3488 java.exe reg.exe PID 3488 wrote to memory of 1432 3488 java.exe reg.exe PID 3488 wrote to memory of 2784 3488 java.exe taskkill.exe PID 3488 wrote to memory of 2784 3488 java.exe taskkill.exe PID 3488 wrote to memory of 2776 3488 java.exe reg.exe PID 3488 wrote to memory of 2776 3488 java.exe reg.exe PID 3488 wrote to memory of 1256 3488 java.exe reg.exe PID 3488 wrote to memory of 1256 3488 java.exe reg.exe PID 3488 wrote to memory of 1744 3488 java.exe reg.exe PID 3488 wrote to memory of 1744 3488 java.exe reg.exe PID 2116 wrote to memory of 1588 2116 cmd.exe reg.exe PID 2116 wrote to memory of 1588 2116 cmd.exe reg.exe PID 3488 wrote to memory of 3788 3488 java.exe reg.exe PID 3488 wrote to memory of 3788 3488 java.exe reg.exe PID 3488 wrote to memory of 1412 3488 java.exe reg.exe PID 3488 wrote to memory of 1080 3488 java.exe reg.exe PID 3488 wrote to memory of 1412 3488 java.exe reg.exe PID 3488 wrote to memory of 1080 3488 java.exe reg.exe PID 3488 wrote to memory of 1156 3488 java.exe reg.exe PID 3488 wrote to memory of 1156 3488 java.exe reg.exe PID 3488 wrote to memory of 3904 3488 java.exe reg.exe PID 3488 wrote to memory of 3904 3488 java.exe reg.exe PID 3488 wrote to memory of 2164 3488 java.exe reg.exe PID 3488 wrote to memory of 2164 3488 java.exe reg.exe PID 3488 wrote to memory of 404 3488 java.exe reg.exe PID 3488 wrote to memory of 404 3488 java.exe reg.exe PID 3488 wrote to memory of 3684 3488 java.exe reg.exe PID 3488 wrote to memory of 3684 3488 java.exe reg.exe PID 3488 wrote to memory of 1748 3488 java.exe reg.exe PID 3488 wrote to memory of 1748 3488 java.exe reg.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 3576 attrib.exe 3688 attrib.exe 2064 attrib.exe 3784 attrib.exe 852 attrib.exe 812 attrib.exe 1128 attrib.exe 3712 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\REN42159.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\tHFwB\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\tHFwB\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\tHFwB2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\tHFwB2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\tHFwB2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\tHFwB\YIYZS.class2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\tHFwB','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\tHFwB\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.ntusernt.ini
-
C:\Users\Admin\tHFwB\Desktop.ini
-
C:\Users\Admin\tHFwB\YIYZS.class
-
\Users\Admin\AppData\Local\Temp\TFroSeoInu2361994479675576130.xml
-
memory/68-233-0x0000000000000000-mapping.dmp
-
memory/404-85-0x0000000000000000-mapping.dmp
-
memory/584-253-0x0000000000000000-mapping.dmp
-
memory/584-221-0x0000000000000000-mapping.dmp
-
memory/584-193-0x0000000000000000-mapping.dmp
-
memory/612-157-0x0000000000000000-mapping.dmp
-
memory/772-125-0x0000000000000000-mapping.dmp
-
memory/812-64-0x0000000000000000-mapping.dmp
-
memory/852-63-0x0000000000000000-mapping.dmp
-
memory/856-189-0x0000000000000000-mapping.dmp
-
memory/988-201-0x0000000000000000-mapping.dmp
-
memory/1000-225-0x0000000000000000-mapping.dmp
-
memory/1008-120-0x0000000000000000-mapping.dmp
-
memory/1076-94-0x0000000000000000-mapping.dmp
-
memory/1076-232-0x0000000000000000-mapping.dmp
-
memory/1080-80-0x0000000000000000-mapping.dmp
-
memory/1128-65-0x0000000000000000-mapping.dmp
-
memory/1144-152-0x0000000000000000-mapping.dmp
-
memory/1148-237-0x0000000000000000-mapping.dmp
-
memory/1148-164-0x0000000000000000-mapping.dmp
-
memory/1156-198-0x0000000000000000-mapping.dmp
-
memory/1156-82-0x0000000000000000-mapping.dmp
-
memory/1236-252-0x0000000000000000-mapping.dmp
-
memory/1236-203-0x0000000000000000-mapping.dmp
-
memory/1236-126-0x0000000000000000-mapping.dmp
-
memory/1236-227-0x0000000000000000-mapping.dmp
-
memory/1244-115-0x0000000000000000-mapping.dmp
-
memory/1256-75-0x0000000000000000-mapping.dmp
-
memory/1268-166-0x0000000000000000-mapping.dmp
-
memory/1276-91-0x0000000000000000-mapping.dmp
-
memory/1316-147-0x0000000000000000-mapping.dmp
-
memory/1316-90-0x0000000000000000-mapping.dmp
-
memory/1360-130-0x0000000000000000-mapping.dmp
-
memory/1392-204-0x0000000000000000-mapping.dmp
-
memory/1412-79-0x0000000000000000-mapping.dmp
-
memory/1432-162-0x0000000000000000-mapping.dmp
-
memory/1432-72-0x0000000000000000-mapping.dmp
-
memory/1476-247-0x0000000000000000-mapping.dmp
-
memory/1588-77-0x0000000000000000-mapping.dmp
-
memory/1596-248-0x0000000000000000-mapping.dmp
-
memory/1608-169-0x0000000000000000-mapping.dmp
-
memory/1652-51-0x0000000000000000-mapping.dmp
-
memory/1720-240-0x0000000000000000-mapping.dmp
-
memory/1744-76-0x0000000000000000-mapping.dmp
-
memory/1748-87-0x0000000000000000-mapping.dmp
-
memory/1904-160-0x0000000000000000-mapping.dmp
-
memory/1964-251-0x0000000000000000-mapping.dmp
-
memory/2064-61-0x0000000000000000-mapping.dmp
-
memory/2116-67-0x0000000000000000-mapping.dmp
-
memory/2120-254-0x0000000000000000-mapping.dmp
-
memory/2120-196-0x0000000000000000-mapping.dmp
-
memory/2164-84-0x0000000000000000-mapping.dmp
-
memory/2176-255-0x0000000000000000-mapping.dmp
-
memory/2248-138-0x0000000000000000-mapping.dmp
-
memory/2312-143-0x0000000000000000-mapping.dmp
-
memory/2324-52-0x0000000000000000-mapping.dmp
-
memory/2608-224-0x0000000000000000-mapping.dmp
-
memory/2608-167-0x0000000000000000-mapping.dmp
-
memory/2648-53-0x0000000000000000-mapping.dmp
-
memory/2668-202-0x0000000000000000-mapping.dmp
-
memory/2668-241-0x0000000000000000-mapping.dmp
-
memory/2696-54-0x0000000000000000-mapping.dmp
-
memory/2776-165-0x0000000000000000-mapping.dmp
-
memory/2776-123-0x0000000000000000-mapping.dmp
-
memory/2776-88-0x0000000000000000-mapping.dmp
-
memory/2776-74-0x0000000000000000-mapping.dmp
-
memory/2784-73-0x0000000000000000-mapping.dmp
-
memory/2784-185-0x0000000000000000-mapping.dmp
-
memory/2788-124-0x0000000000000000-mapping.dmp
-
memory/3000-92-0x0000000000000000-mapping.dmp
-
memory/3020-98-0x0000014075DF0000-0x0000014075DF1000-memory.dmpFilesize
4KB
-
memory/3020-106-0x0000014075FA0000-0x0000014075FA1000-memory.dmpFilesize
4KB
-
memory/3020-81-0x00007FFCD2DD0000-0x00007FFCD37BC000-memory.dmpFilesize
9.9MB
-
memory/3020-69-0x0000000000000000-mapping.dmp
-
memory/3064-89-0x0000000000000000-mapping.dmp
-
memory/3064-172-0x0000000000000000-mapping.dmp
-
memory/3064-129-0x0000000000000000-mapping.dmp
-
memory/3372-151-0x0000000000000000-mapping.dmp
-
memory/3576-58-0x0000000000000000-mapping.dmp
-
memory/3596-55-0x0000000000000000-mapping.dmp
-
memory/3684-86-0x0000000000000000-mapping.dmp
-
memory/3688-60-0x0000000000000000-mapping.dmp
-
memory/3712-56-0x0000000000000000-mapping.dmp
-
memory/3784-62-0x0000000000000000-mapping.dmp
-
memory/3788-78-0x0000000000000000-mapping.dmp
-
memory/3788-93-0x0000000000000000-mapping.dmp
-
memory/3788-205-0x0000000000000000-mapping.dmp
-
memory/3792-235-0x0000000000000000-mapping.dmp
-
memory/3856-161-0x0000000000000000-mapping.dmp
-
memory/3860-257-0x0000000000000000-mapping.dmp
-
memory/3880-222-0x0000000000000000-mapping.dmp
-
memory/3880-71-0x0000000000000000-mapping.dmp
-
memory/3892-163-0x0000000000000000-mapping.dmp
-
memory/3904-118-0x0000000000000000-mapping.dmp
-
memory/3904-83-0x0000000000000000-mapping.dmp
-
memory/4020-116-0x0000000000000000-mapping.dmp
-
memory/4024-223-0x0000000000000000-mapping.dmp
-
memory/4048-70-0x0000000000000000-mapping.dmp
-
memory/4112-95-0x0000000000000000-mapping.dmp
-
memory/4128-119-0x0000000000000000-mapping.dmp
-
memory/4140-219-0x0000000000000000-mapping.dmp
-
memory/4144-246-0x0000000000000000-mapping.dmp
-
memory/4148-190-0x0000000000000000-mapping.dmp
-
memory/4152-131-0x0000000000000000-mapping.dmp
-
memory/4160-171-0x0000000000000000-mapping.dmp
-
memory/4168-183-0x0000000000000000-mapping.dmp
-
memory/4180-176-0x0000000000000000-mapping.dmp
-
memory/4180-135-0x0000000000000000-mapping.dmp
-
memory/4192-122-0x0000000000000000-mapping.dmp
-
memory/4192-200-0x0000000000000000-mapping.dmp
-
memory/4196-199-0x0000000000000000-mapping.dmp
-
memory/4208-96-0x0000000000000000-mapping.dmp
-
memory/4224-140-0x0000000000000000-mapping.dmp
-
memory/4228-121-0x0000000000000000-mapping.dmp
-
memory/4264-133-0x0000000000000000-mapping.dmp
-
memory/4268-128-0x0000000000000000-mapping.dmp
-
memory/4284-132-0x0000000000000000-mapping.dmp
-
memory/4292-136-0x0000000000000000-mapping.dmp
-
memory/4304-97-0x0000000000000000-mapping.dmp
-
memory/4312-127-0x0000000000000000-mapping.dmp
-
memory/4332-174-0x0000000000000000-mapping.dmp
-
memory/4332-206-0x0000000000000000-mapping.dmp
-
memory/4356-178-0x0000000000000000-mapping.dmp
-
memory/4372-173-0x0000000000000000-mapping.dmp
-
memory/4380-242-0x0000000000000000-mapping.dmp
-
memory/4412-139-0x0000000000000000-mapping.dmp
-
memory/4432-99-0x0000000000000000-mapping.dmp
-
memory/4436-141-0x0000000000000000-mapping.dmp
-
memory/4436-212-0x0000000000000000-mapping.dmp
-
memory/4464-137-0x0000000000000000-mapping.dmp
-
memory/4480-228-0x0000000000000000-mapping.dmp
-
memory/4492-100-0x0000000000000000-mapping.dmp
-
memory/4496-142-0x0000000000000000-mapping.dmp
-
memory/4496-250-0x0000000000000000-mapping.dmp
-
memory/4504-179-0x0000000000000000-mapping.dmp
-
memory/4504-209-0x0000000000000000-mapping.dmp
-
memory/4504-231-0x0000000000000000-mapping.dmp
-
memory/4512-243-0x0000000000000000-mapping.dmp
-
memory/4512-134-0x0000000000000000-mapping.dmp
-
memory/4520-175-0x0000000000000000-mapping.dmp
-
memory/4520-207-0x0000000000000000-mapping.dmp
-
memory/4532-213-0x0000000000000000-mapping.dmp
-
memory/4532-101-0x0000000000000000-mapping.dmp
-
memory/4540-181-0x0000000000000000-mapping.dmp
-
memory/4560-177-0x0000000000000000-mapping.dmp
-
memory/4584-146-0x0000000000000000-mapping.dmp
-
memory/4588-229-0x0000000000000000-mapping.dmp
-
memory/4612-102-0x0000000000000000-mapping.dmp
-
memory/4616-180-0x0000000000000000-mapping.dmp
-
memory/4632-145-0x0000000000000000-mapping.dmp
-
memory/4640-230-0x0000000000000000-mapping.dmp
-
memory/4640-208-0x0000000000000000-mapping.dmp
-
memory/4676-103-0x0000000000000000-mapping.dmp
-
memory/4676-216-0x0000000000000000-mapping.dmp
-
memory/4680-149-0x0000000000000000-mapping.dmp
-
memory/4688-104-0x0000000000000000-mapping.dmp
-
memory/4700-244-0x0000000000000000-mapping.dmp
-
memory/4728-215-0x0000000000000000-mapping.dmp
-
memory/4728-182-0x0000000000000000-mapping.dmp
-
memory/4744-256-0x0000000000000000-mapping.dmp
-
memory/4744-150-0x0000000000000000-mapping.dmp
-
memory/4752-144-0x0000000000000000-mapping.dmp
-
memory/4768-220-0x0000000000000000-mapping.dmp
-
memory/4768-238-0x0000000000000000-mapping.dmp
-
memory/4788-214-0x0000000000000000-mapping.dmp
-
memory/4800-249-0x0000000000000000-mapping.dmp
-
memory/4804-191-0x0000000000000000-mapping.dmp
-
memory/4812-186-0x0000000000000000-mapping.dmp
-
memory/4844-105-0x0000000000000000-mapping.dmp
-
memory/4848-217-0x0000000000000000-mapping.dmp
-
memory/4864-148-0x0000000000000000-mapping.dmp
-
memory/4864-184-0x0000000000000000-mapping.dmp
-
memory/4884-245-0x0000000000000000-mapping.dmp
-
memory/4888-192-0x0000000000000000-mapping.dmp
-
memory/4904-107-0x0000000000000000-mapping.dmp
-
memory/4916-187-0x0000000000000000-mapping.dmp
-
memory/4924-153-0x0000000000000000-mapping.dmp
-
memory/4924-234-0x0000000000000000-mapping.dmp
-
memory/4932-108-0x0000000000000000-mapping.dmp
-
memory/4948-154-0x0000000000000000-mapping.dmp
-
memory/4968-109-0x0000000000000000-mapping.dmp
-
memory/4972-155-0x0000000000000000-mapping.dmp
-
memory/4980-218-0x0000000000000000-mapping.dmp
-
memory/4992-226-0x0000000000000000-mapping.dmp
-
memory/4996-110-0x0000000000000000-mapping.dmp
-
memory/5004-188-0x0000000000000000-mapping.dmp
-
memory/5008-236-0x0000000000000000-mapping.dmp
-
memory/5016-159-0x0000000000000000-mapping.dmp
-
memory/5036-111-0x0000000000000000-mapping.dmp
-
memory/5052-239-0x0000000000000000-mapping.dmp
-
memory/5056-158-0x0000000000000000-mapping.dmp
-
memory/5080-113-0x0000000000000000-mapping.dmp
-
memory/5096-156-0x0000000000000000-mapping.dmp
-
memory/5116-114-0x0000000000000000-mapping.dmp
-
memory/5116-197-0x0000000000000000-mapping.dmp
-
memory/5136-258-0x0000000000000000-mapping.dmp
-
memory/5172-259-0x0000000000000000-mapping.dmp
-
memory/5236-260-0x0000000000000000-mapping.dmp
-
memory/5300-261-0x0000000000000000-mapping.dmp
-
memory/5364-262-0x0000000000000000-mapping.dmp
-
memory/5424-263-0x0000000000000000-mapping.dmp
-
memory/5484-264-0x0000000000000000-mapping.dmp