Analysis
-
max time kernel
113s -
max time network
146s -
platform
windows7_x64 -
resource
win7 -
submitted
18-08-2020 19:48
Static task
static1
Behavioral task
behavioral1
Sample
Quote.jar
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quote.jar
Resource
win10
0 signatures
0 seconds
General
-
Target
Quote.jar
-
Size
399KB
-
MD5
2b68744fed1c4c5c156a4247160fa8f8
-
SHA1
50cb830acadbe050d1cdd3cc1e8516e76a9ab30b
-
SHA256
e06e4d0ce2a189209e34ee24832d021418781872dae863ffa2b4126b14e17b15
-
SHA512
4ed06e23b899d465efc0b75a42b283a48c07eb8ae0dd1848df7a700032324a6a8d7368bb2bad5b7ccc4041b7fd2df447bc60278d65a717989f82d8fff771fe49
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\ShWppiKiTP5227829676112080536.xml qarallax_dll -
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 1460 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DEPOFJF = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\UaoPj\\SbBYi.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DEPOFJF = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\UaoPj\\SbBYi.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
java.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\UaoPj\Desktop.ini java.exe File created C:\Users\Admin\UaoPj\Desktop.ini java.exe File opened for modification C:\Users\Admin\UaoPj\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\UaoPj\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Windows\System32\Zbotx java.exe File created C:\Windows\System32\Zbotx java.exe -
Kills process with taskkill 16 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2056 taskkill.exe 2036 taskkill.exe 1888 taskkill.exe 1056 taskkill.exe 2708 taskkill.exe 2828 taskkill.exe 1416 taskkill.exe 1872 taskkill.exe 2168 taskkill.exe 2460 taskkill.exe 2556 taskkill.exe 1072 taskkill.exe 1996 taskkill.exe 1332 taskkill.exe 1864 taskkill.exe 2280 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1628 powershell.exe 1628 powershell.exe -
Suspicious use of AdjustPrivilegeToken 137 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1536 WMIC.exe Token: SeSecurityPrivilege 1536 WMIC.exe Token: SeTakeOwnershipPrivilege 1536 WMIC.exe Token: SeLoadDriverPrivilege 1536 WMIC.exe Token: SeSystemProfilePrivilege 1536 WMIC.exe Token: SeSystemtimePrivilege 1536 WMIC.exe Token: SeProfSingleProcessPrivilege 1536 WMIC.exe Token: SeIncBasePriorityPrivilege 1536 WMIC.exe Token: SeCreatePagefilePrivilege 1536 WMIC.exe Token: SeBackupPrivilege 1536 WMIC.exe Token: SeRestorePrivilege 1536 WMIC.exe Token: SeShutdownPrivilege 1536 WMIC.exe Token: SeDebugPrivilege 1536 WMIC.exe Token: SeSystemEnvironmentPrivilege 1536 WMIC.exe Token: SeRemoteShutdownPrivilege 1536 WMIC.exe Token: SeUndockPrivilege 1536 WMIC.exe Token: SeManageVolumePrivilege 1536 WMIC.exe Token: 33 1536 WMIC.exe Token: 34 1536 WMIC.exe Token: 35 1536 WMIC.exe Token: SeIncreaseQuotaPrivilege 1536 WMIC.exe Token: SeSecurityPrivilege 1536 WMIC.exe Token: SeTakeOwnershipPrivilege 1536 WMIC.exe Token: SeLoadDriverPrivilege 1536 WMIC.exe Token: SeSystemProfilePrivilege 1536 WMIC.exe Token: SeSystemtimePrivilege 1536 WMIC.exe Token: SeProfSingleProcessPrivilege 1536 WMIC.exe Token: SeIncBasePriorityPrivilege 1536 WMIC.exe Token: SeCreatePagefilePrivilege 1536 WMIC.exe Token: SeBackupPrivilege 1536 WMIC.exe Token: SeRestorePrivilege 1536 WMIC.exe Token: SeShutdownPrivilege 1536 WMIC.exe Token: SeDebugPrivilege 1536 WMIC.exe Token: SeSystemEnvironmentPrivilege 1536 WMIC.exe Token: SeRemoteShutdownPrivilege 1536 WMIC.exe Token: SeUndockPrivilege 1536 WMIC.exe Token: SeManageVolumePrivilege 1536 WMIC.exe Token: 33 1536 WMIC.exe Token: 34 1536 WMIC.exe Token: 35 1536 WMIC.exe Token: SeIncreaseQuotaPrivilege 1816 WMIC.exe Token: SeSecurityPrivilege 1816 WMIC.exe Token: SeTakeOwnershipPrivilege 1816 WMIC.exe Token: SeLoadDriverPrivilege 1816 WMIC.exe Token: SeSystemProfilePrivilege 1816 WMIC.exe Token: SeSystemtimePrivilege 1816 WMIC.exe Token: SeProfSingleProcessPrivilege 1816 WMIC.exe Token: SeIncBasePriorityPrivilege 1816 WMIC.exe Token: SeCreatePagefilePrivilege 1816 WMIC.exe Token: SeBackupPrivilege 1816 WMIC.exe Token: SeRestorePrivilege 1816 WMIC.exe Token: SeShutdownPrivilege 1816 WMIC.exe Token: SeDebugPrivilege 1816 WMIC.exe Token: SeSystemEnvironmentPrivilege 1816 WMIC.exe Token: SeRemoteShutdownPrivilege 1816 WMIC.exe Token: SeUndockPrivilege 1816 WMIC.exe Token: SeManageVolumePrivilege 1816 WMIC.exe Token: 33 1816 WMIC.exe Token: 34 1816 WMIC.exe Token: 35 1816 WMIC.exe Token: SeIncreaseQuotaPrivilege 1816 WMIC.exe Token: SeSecurityPrivilege 1816 WMIC.exe Token: SeTakeOwnershipPrivilege 1816 WMIC.exe Token: SeLoadDriverPrivilege 1816 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 1460 java.exe -
Suspicious use of WriteProcessMemory 714 IoCs
Processes:
java.execmd.execmd.execmd.exedescription pid process target process PID 1460 wrote to memory of 1644 1460 java.exe cmd.exe PID 1460 wrote to memory of 1644 1460 java.exe cmd.exe PID 1460 wrote to memory of 1644 1460 java.exe cmd.exe PID 1460 wrote to memory of 1056 1460 java.exe cmd.exe PID 1460 wrote to memory of 1056 1460 java.exe cmd.exe PID 1460 wrote to memory of 1056 1460 java.exe cmd.exe PID 1056 wrote to memory of 1536 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 1536 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 1536 1056 cmd.exe WMIC.exe PID 1460 wrote to memory of 1760 1460 java.exe cmd.exe PID 1460 wrote to memory of 1760 1460 java.exe cmd.exe PID 1460 wrote to memory of 1760 1460 java.exe cmd.exe PID 1760 wrote to memory of 1816 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1816 1760 cmd.exe WMIC.exe PID 1760 wrote to memory of 1816 1760 cmd.exe WMIC.exe PID 1460 wrote to memory of 1852 1460 java.exe attrib.exe PID 1460 wrote to memory of 1852 1460 java.exe attrib.exe PID 1460 wrote to memory of 1852 1460 java.exe attrib.exe PID 1460 wrote to memory of 1284 1460 java.exe attrib.exe PID 1460 wrote to memory of 1284 1460 java.exe attrib.exe PID 1460 wrote to memory of 1284 1460 java.exe attrib.exe PID 1460 wrote to memory of 1900 1460 java.exe attrib.exe PID 1460 wrote to memory of 1900 1460 java.exe attrib.exe PID 1460 wrote to memory of 1900 1460 java.exe attrib.exe PID 1460 wrote to memory of 1896 1460 java.exe attrib.exe PID 1460 wrote to memory of 1896 1460 java.exe attrib.exe PID 1460 wrote to memory of 1896 1460 java.exe attrib.exe PID 1460 wrote to memory of 1868 1460 java.exe attrib.exe PID 1460 wrote to memory of 1868 1460 java.exe attrib.exe PID 1460 wrote to memory of 1868 1460 java.exe attrib.exe PID 1460 wrote to memory of 1828 1460 java.exe attrib.exe PID 1460 wrote to memory of 1828 1460 java.exe attrib.exe PID 1460 wrote to memory of 1828 1460 java.exe attrib.exe PID 1460 wrote to memory of 1832 1460 java.exe attrib.exe PID 1460 wrote to memory of 1832 1460 java.exe attrib.exe PID 1460 wrote to memory of 1832 1460 java.exe attrib.exe PID 1460 wrote to memory of 1756 1460 java.exe attrib.exe PID 1460 wrote to memory of 1756 1460 java.exe attrib.exe PID 1460 wrote to memory of 1756 1460 java.exe attrib.exe PID 1460 wrote to memory of 1588 1460 java.exe cmd.exe PID 1460 wrote to memory of 1588 1460 java.exe cmd.exe PID 1460 wrote to memory of 1588 1460 java.exe cmd.exe PID 1588 wrote to memory of 1580 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1580 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1580 1588 cmd.exe reg.exe PID 1460 wrote to memory of 1628 1460 java.exe powershell.exe PID 1460 wrote to memory of 1628 1460 java.exe powershell.exe PID 1460 wrote to memory of 1628 1460 java.exe powershell.exe PID 1460 wrote to memory of 1992 1460 java.exe reg.exe PID 1460 wrote to memory of 1992 1460 java.exe reg.exe PID 1460 wrote to memory of 1992 1460 java.exe reg.exe PID 1460 wrote to memory of 1956 1460 java.exe reg.exe PID 1460 wrote to memory of 1956 1460 java.exe reg.exe PID 1460 wrote to memory of 1956 1460 java.exe reg.exe PID 1460 wrote to memory of 2036 1460 java.exe taskkill.exe PID 1460 wrote to memory of 2036 1460 java.exe taskkill.exe PID 1460 wrote to memory of 2036 1460 java.exe taskkill.exe PID 1588 wrote to memory of 1996 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1996 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1996 1588 cmd.exe reg.exe PID 1460 wrote to memory of 836 1460 java.exe reg.exe PID 1460 wrote to memory of 836 1460 java.exe reg.exe PID 1460 wrote to memory of 836 1460 java.exe reg.exe PID 1460 wrote to memory of 1180 1460 java.exe reg.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1896 attrib.exe 1868 attrib.exe 1828 attrib.exe 1832 attrib.exe 1756 attrib.exe 1852 attrib.exe 1284 attrib.exe 1900 attrib.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Quote.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\UaoPj\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\UaoPj\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\UaoPj\SbBYi.class2⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\UaoPj','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\UaoPj\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.ntusernt.ini
-
C:\Users\Admin\UaoPj\Desktop.ini
-
C:\Users\Admin\UaoPj\SbBYi.class
-
\Users\Admin\AppData\Local\Temp\ShWppiKiTP5227829676112080536.xml
-
memory/240-196-0x0000000000000000-mapping.dmp
-
memory/240-51-0x0000000000000000-mapping.dmp
-
memory/368-29-0x0000000000000000-mapping.dmp
-
memory/572-160-0x0000000000000000-mapping.dmp
-
memory/612-137-0x0000000000000000-mapping.dmp
-
memory/680-76-0x0000000000000000-mapping.dmp
-
memory/752-243-0x0000000000000000-mapping.dmp
-
memory/756-56-0x0000000000000000-mapping.dmp
-
memory/756-170-0x0000000000000000-mapping.dmp
-
memory/768-37-0x0000000000000000-mapping.dmp
-
memory/828-241-0x0000000000000000-mapping.dmp
-
memory/832-54-0x0000000000000000-mapping.dmp
-
memory/836-25-0x0000000000000000-mapping.dmp
-
memory/852-27-0x0000000000000000-mapping.dmp
-
memory/932-71-0x0000000000000000-mapping.dmp
-
memory/940-174-0x0000000000000000-mapping.dmp
-
memory/1004-255-0x0000000000000000-mapping.dmp
-
memory/1004-161-0x0000000000000000-mapping.dmp
-
memory/1044-44-0x0000000000000000-mapping.dmp
-
memory/1044-64-0x0000000000000000-mapping.dmp
-
memory/1048-253-0x0000000000000000-mapping.dmp
-
memory/1048-159-0x0000000000000000-mapping.dmp
-
memory/1052-63-0x0000000000000000-mapping.dmp
-
memory/1056-45-0x0000000000000000-mapping.dmp
-
memory/1056-2-0x0000000000000000-mapping.dmp
-
memory/1072-32-0x0000000000000000-mapping.dmp
-
memory/1084-57-0x0000000000000000-mapping.dmp
-
memory/1120-257-0x0000000000000000-mapping.dmp
-
memory/1124-39-0x0000000000000000-mapping.dmp
-
memory/1148-36-0x0000000000000000-mapping.dmp
-
memory/1180-26-0x0000000000000000-mapping.dmp
-
memory/1204-173-0x0000000000000000-mapping.dmp
-
memory/1284-8-0x0000000000000000-mapping.dmp
-
memory/1284-256-0x0000000000000000-mapping.dmp
-
memory/1332-67-0x0000000000000000-mapping.dmp
-
memory/1372-68-0x0000000000000000-mapping.dmp
-
memory/1376-168-0x0000000000000000-mapping.dmp
-
memory/1388-31-0x0000000000000000-mapping.dmp
-
memory/1388-259-0x0000000000000000-mapping.dmp
-
memory/1416-169-0x0000000000000000-mapping.dmp
-
memory/1416-55-0x0000000000000000-mapping.dmp
-
memory/1424-53-0x0000000000000000-mapping.dmp
-
memory/1492-171-0x0000000000000000-mapping.dmp
-
memory/1504-157-0x0000000000000000-mapping.dmp
-
memory/1520-58-0x0000000000000000-mapping.dmp
-
memory/1524-252-0x0000000000000000-mapping.dmp
-
memory/1528-34-0x0000000000000000-mapping.dmp
-
memory/1532-33-0x0000000000000000-mapping.dmp
-
memory/1536-3-0x0000000000000000-mapping.dmp
-
memory/1556-195-0x0000000000000000-mapping.dmp
-
memory/1568-69-0x0000000000000000-mapping.dmp
-
memory/1568-28-0x0000000000000000-mapping.dmp
-
memory/1580-49-0x0000000000000000-mapping.dmp
-
memory/1580-19-0x0000000000000000-mapping.dmp
-
memory/1584-172-0x0000000000000000-mapping.dmp
-
memory/1588-18-0x0000000000000000-mapping.dmp
-
memory/1592-73-0x0000000000000000-mapping.dmp
-
memory/1628-20-0x0000000000000000-mapping.dmp
-
memory/1628-146-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/1628-83-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/1628-145-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/1628-94-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/1628-128-0x0000000002960000-0x0000000002961000-memory.dmpFilesize
4KB
-
memory/1628-30-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmpFilesize
9.9MB
-
memory/1628-119-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/1628-84-0x000000001ACE0000-0x000000001ACE1000-memory.dmpFilesize
4KB
-
memory/1628-87-0x0000000002520000-0x0000000002521000-memory.dmpFilesize
4KB
-
memory/1644-1-0x0000000000000000-mapping.dmp
-
memory/1676-177-0x0000000000000000-mapping.dmp
-
memory/1692-61-0x0000000000000000-mapping.dmp
-
memory/1696-263-0x0000000000000000-mapping.dmp
-
memory/1740-46-0x0000000000000000-mapping.dmp
-
memory/1756-16-0x0000000000000000-mapping.dmp
-
memory/1760-4-0x0000000000000000-mapping.dmp
-
memory/1764-75-0x0000000000000000-mapping.dmp
-
memory/1764-35-0x0000000000000000-mapping.dmp
-
memory/1764-70-0x0000000000000000-mapping.dmp
-
memory/1772-59-0x0000000000000000-mapping.dmp
-
memory/1792-176-0x0000000000000000-mapping.dmp
-
memory/1796-190-0x0000000000000000-mapping.dmp
-
memory/1816-5-0x0000000000000000-mapping.dmp
-
memory/1824-164-0x0000000000000000-mapping.dmp
-
memory/1828-14-0x0000000000000000-mapping.dmp
-
memory/1832-15-0x0000000000000000-mapping.dmp
-
memory/1836-258-0x0000000000000000-mapping.dmp
-
memory/1836-165-0x0000000000000000-mapping.dmp
-
memory/1840-167-0x0000000000000000-mapping.dmp
-
memory/1852-158-0x0000000000000000-mapping.dmp
-
memory/1852-6-0x0000000000000000-mapping.dmp
-
memory/1864-72-0x0000000000000000-mapping.dmp
-
memory/1864-41-0x0000000000000000-mapping.dmp
-
memory/1864-62-0x0000000000000000-mapping.dmp
-
memory/1864-182-0x0000000000000000-mapping.dmp
-
memory/1868-43-0x0000000000000000-mapping.dmp
-
memory/1868-12-0x0000000000000000-mapping.dmp
-
memory/1872-60-0x0000000000000000-mapping.dmp
-
memory/1888-166-0x0000000000000000-mapping.dmp
-
memory/1888-38-0x0000000000000000-mapping.dmp
-
memory/1892-40-0x0000000000000000-mapping.dmp
-
memory/1896-11-0x0000000000000000-mapping.dmp
-
memory/1900-10-0x0000000000000000-mapping.dmp
-
memory/1924-42-0x0000000000000000-mapping.dmp
-
memory/1940-181-0x0000000000000000-mapping.dmp
-
memory/1948-48-0x0000000000000000-mapping.dmp
-
memory/1948-66-0x0000000000000000-mapping.dmp
-
memory/1948-74-0x0000000000000000-mapping.dmp
-
memory/1948-221-0x0000000000000000-mapping.dmp
-
memory/1952-262-0x0000000000000000-mapping.dmp
-
memory/1956-22-0x0000000000000000-mapping.dmp
-
memory/1992-52-0x0000000000000000-mapping.dmp
-
memory/1992-21-0x0000000000000000-mapping.dmp
-
memory/1996-24-0x0000000000000000-mapping.dmp
-
memory/1996-50-0x0000000000000000-mapping.dmp
-
memory/2004-254-0x0000000000000000-mapping.dmp
-
memory/2008-197-0x0000000000000000-mapping.dmp
-
memory/2012-245-0x0000000000000000-mapping.dmp
-
memory/2016-260-0x0000000000000000-mapping.dmp
-
memory/2016-47-0x0000000000000000-mapping.dmp
-
memory/2020-189-0x0000000000000000-mapping.dmp
-
memory/2036-23-0x0000000000000000-mapping.dmp
-
memory/2040-162-0x0000000000000000-mapping.dmp
-
memory/2044-180-0x0000000000000000-mapping.dmp
-
memory/2044-65-0x0000000000000000-mapping.dmp
-
memory/2056-77-0x0000000000000000-mapping.dmp
-
memory/2064-222-0x0000000000000000-mapping.dmp
-
memory/2080-175-0x0000000000000000-mapping.dmp
-
memory/2088-78-0x0000000000000000-mapping.dmp
-
memory/2100-200-0x0000000000000000-mapping.dmp
-
memory/2108-79-0x0000000000000000-mapping.dmp
-
memory/2116-141-0x0000000000000000-mapping.dmp
-
memory/2128-226-0x0000000000000000-mapping.dmp
-
memory/2128-80-0x0000000000000000-mapping.dmp
-
memory/2144-191-0x0000000000000000-mapping.dmp
-
memory/2156-81-0x0000000000000000-mapping.dmp
-
memory/2164-230-0x0000000000000000-mapping.dmp
-
memory/2168-82-0x0000000000000000-mapping.dmp
-
memory/2172-193-0x0000000000000000-mapping.dmp
-
memory/2188-144-0x0000000000000000-mapping.dmp
-
memory/2196-198-0x0000000000000000-mapping.dmp
-
memory/2204-85-0x0000000000000000-mapping.dmp
-
memory/2216-201-0x0000000000000000-mapping.dmp
-
memory/2224-86-0x0000000000000000-mapping.dmp
-
memory/2224-148-0x0000000000000000-mapping.dmp
-
memory/2232-235-0x0000000000000000-mapping.dmp
-
memory/2232-147-0x0000000000000000-mapping.dmp
-
memory/2236-231-0x0000000000000000-mapping.dmp
-
memory/2256-88-0x0000000000000000-mapping.dmp
-
memory/2264-236-0x0000000000000000-mapping.dmp
-
memory/2268-185-0x0000000000000000-mapping.dmp
-
memory/2276-192-0x0000000000000000-mapping.dmp
-
memory/2280-89-0x0000000000000000-mapping.dmp
-
memory/2288-232-0x0000000000000000-mapping.dmp
-
memory/2292-90-0x0000000000000000-mapping.dmp
-
memory/2308-149-0x0000000000000000-mapping.dmp
-
memory/2328-194-0x0000000000000000-mapping.dmp
-
memory/2344-240-0x0000000000000000-mapping.dmp
-
memory/2344-91-0x0000000000000000-mapping.dmp
-
memory/2364-151-0x0000000000000000-mapping.dmp
-
memory/2364-92-0x0000000000000000-mapping.dmp
-
memory/2368-150-0x0000000000000000-mapping.dmp
-
memory/2384-93-0x0000000000000000-mapping.dmp
-
memory/2400-242-0x0000000000000000-mapping.dmp
-
memory/2408-247-0x0000000000000000-mapping.dmp
-
memory/2412-153-0x0000000000000000-mapping.dmp
-
memory/2412-95-0x0000000000000000-mapping.dmp
-
memory/2416-152-0x0000000000000000-mapping.dmp
-
memory/2436-186-0x0000000000000000-mapping.dmp
-
memory/2460-96-0x0000000000000000-mapping.dmp
-
memory/2464-229-0x0000000000000000-mapping.dmp
-
memory/2468-154-0x0000000000000000-mapping.dmp
-
memory/2472-97-0x0000000000000000-mapping.dmp
-
memory/2476-248-0x0000000000000000-mapping.dmp
-
memory/2480-246-0x0000000000000000-mapping.dmp
-
memory/2504-98-0x0000000000000000-mapping.dmp
-
memory/2532-99-0x0000000000000000-mapping.dmp
-
memory/2536-249-0x0000000000000000-mapping.dmp
-
memory/2544-100-0x0000000000000000-mapping.dmp
-
memory/2548-250-0x0000000000000000-mapping.dmp
-
memory/2548-155-0x0000000000000000-mapping.dmp
-
memory/2556-101-0x0000000000000000-mapping.dmp
-
memory/2560-225-0x0000000000000000-mapping.dmp
-
memory/2564-202-0x0000000000000000-mapping.dmp
-
memory/2568-102-0x0000000000000000-mapping.dmp
-
memory/2580-251-0x0000000000000000-mapping.dmp
-
memory/2580-156-0x0000000000000000-mapping.dmp
-
memory/2592-261-0x0000000000000000-mapping.dmp
-
memory/2596-163-0x0000000000000000-mapping.dmp
-
memory/2604-244-0x0000000000000000-mapping.dmp
-
memory/2608-103-0x0000000000000000-mapping.dmp
-
memory/2612-264-0x0000000000000000-mapping.dmp
-
memory/2628-104-0x0000000000000000-mapping.dmp
-
memory/2632-178-0x0000000000000000-mapping.dmp
-
memory/2652-105-0x0000000000000000-mapping.dmp
-
memory/2664-106-0x0000000000000000-mapping.dmp
-
memory/2672-203-0x0000000000000000-mapping.dmp
-
memory/2676-179-0x0000000000000000-mapping.dmp
-
memory/2680-224-0x0000000000000000-mapping.dmp
-
memory/2684-107-0x0000000000000000-mapping.dmp
-
memory/2692-183-0x0000000000000000-mapping.dmp
-
memory/2696-108-0x0000000000000000-mapping.dmp
-
memory/2708-109-0x0000000000000000-mapping.dmp
-
memory/2712-238-0x0000000000000000-mapping.dmp
-
memory/2716-184-0x0000000000000000-mapping.dmp
-
memory/2720-110-0x0000000000000000-mapping.dmp
-
memory/2720-204-0x0000000000000000-mapping.dmp
-
memory/2724-199-0x0000000000000000-mapping.dmp
-
memory/2732-239-0x0000000000000000-mapping.dmp
-
memory/2748-187-0x0000000000000000-mapping.dmp
-
memory/2752-188-0x0000000000000000-mapping.dmp
-
memory/2764-237-0x0000000000000000-mapping.dmp
-
memory/2768-228-0x0000000000000000-mapping.dmp
-
memory/2780-111-0x0000000000000000-mapping.dmp
-
memory/2788-205-0x0000000000000000-mapping.dmp
-
memory/2792-112-0x0000000000000000-mapping.dmp
-
memory/2804-113-0x0000000000000000-mapping.dmp
-
memory/2804-207-0x0000000000000000-mapping.dmp
-
memory/2812-206-0x0000000000000000-mapping.dmp
-
memory/2816-114-0x0000000000000000-mapping.dmp
-
memory/2816-208-0x0000000000000000-mapping.dmp
-
memory/2828-234-0x0000000000000000-mapping.dmp
-
memory/2828-115-0x0000000000000000-mapping.dmp
-
memory/2856-116-0x0000000000000000-mapping.dmp
-
memory/2868-233-0x0000000000000000-mapping.dmp
-
memory/2872-117-0x0000000000000000-mapping.dmp
-
memory/2872-209-0x0000000000000000-mapping.dmp
-
memory/2884-118-0x0000000000000000-mapping.dmp
-
memory/2892-210-0x0000000000000000-mapping.dmp
-
memory/2900-120-0x0000000000000000-mapping.dmp
-
memory/2908-211-0x0000000000000000-mapping.dmp
-
memory/2916-121-0x0000000000000000-mapping.dmp
-
memory/2916-213-0x0000000000000000-mapping.dmp
-
memory/2932-227-0x0000000000000000-mapping.dmp
-
memory/2936-223-0x0000000000000000-mapping.dmp
-
memory/2948-122-0x0000000000000000-mapping.dmp
-
memory/2952-212-0x0000000000000000-mapping.dmp
-
memory/2960-123-0x0000000000000000-mapping.dmp
-
memory/2972-214-0x0000000000000000-mapping.dmp
-
memory/2976-215-0x0000000000000000-mapping.dmp
-
memory/2980-126-0x0000000000000000-mapping.dmp
-
memory/2992-127-0x0000000000000000-mapping.dmp
-
memory/3008-216-0x0000000000000000-mapping.dmp
-
memory/3016-129-0x0000000000000000-mapping.dmp
-
memory/3024-217-0x0000000000000000-mapping.dmp
-
memory/3044-218-0x0000000000000000-mapping.dmp
-
memory/3052-220-0x0000000000000000-mapping.dmp
-
memory/3052-133-0x0000000000000000-mapping.dmp
-
memory/3068-219-0x0000000000000000-mapping.dmp