Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 22:53

General

  • Target

    fe196add855b16dc1b8e80729610a4e0.exe

  • Size

    3.6MB

  • MD5

    fe196add855b16dc1b8e80729610a4e0

  • SHA1

    f44efb48cda5958e5603b36d1a59709a847fc0e7

  • SHA256

    1545645f6c5ecc9f14ee924de8ad3dea051e24a8fca9b34beedf958cae0c1b90

  • SHA512

    78285eb98cefe794720d198509e4ccacfead6546dd0d70594bc137a41c99b6db2d8f5db1a5b674283396165b5fda7a970d34dff376dead59ba67c5e583e2075a

  • SSDEEP

    98304:qGk6+Wzyy2Js1c8YlQvtGSpQVYQahXSj68h761:DtZz9msbEbvVY06CQ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 21 IoCs
  • Gathers network information 2 TTPs 5 IoCs

    Uses commandline utility to view network configuration.

  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
    "C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\is-1JQJ6.tmp\fe196add855b16dc1b8e80729610a4e0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1JQJ6.tmp\fe196add855b16dc1b8e80729610a4e0.tmp" /SL5="$80092,3326047,56832,C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-U8IQC.tmp\ex.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
          4⤵
            PID:1184
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
          3⤵
            PID:2344
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
              4⤵
                PID:3400
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
              3⤵
                PID:5116
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                3⤵
                  PID:3672
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                  3⤵
                    PID:4252
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
                      4⤵
                        PID:2024
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
                          5⤵
                          • Enumerates processes with tasklist
                          PID:1188
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                      3⤵
                        PID:4064
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                          4⤵
                            PID:2188
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                          3⤵
                            PID:3388
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                              4⤵
                                PID:4720
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                                  5⤵
                                  • Enumerates processes with tasklist
                                  PID:1972
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5901 " | findstr /C:"ESTABLISHED"
                              3⤵
                                PID:224
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /C:"ESTABLISHED"
                                  4⤵
                                    PID:728
                                  • C:\Windows\SysWOW64\findstr.exe
                                    findstr /C:":5901 "
                                    4⤵
                                      PID:1524
                                    • C:\Windows\SysWOW64\NETSTAT.EXE
                                      netstat -na
                                      4⤵
                                      • Gathers network information
                                      PID:5004
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5904 " | findstr /C:"ESTABLISHED"
                                    3⤵
                                      PID:2100
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /C:"ESTABLISHED"
                                        4⤵
                                          PID:1700
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr /C:":5904 "
                                          4⤵
                                            PID:2604
                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                            netstat -na
                                            4⤵
                                            • Gathers network information
                                            PID:3468
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                          3⤵
                                            PID:3376
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                              4⤵
                                                PID:4072
                                            • C:\Users\Admin\AppData\Local\Temp\is-U8IQC.tmp\gentlemjmp_irow.exe
                                              "C:\Users\Admin\AppData\Local\Temp\is-U8IQC.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
                                              3⤵
                                                PID:2780
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                3⤵
                                                  PID:4968
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                  3⤵
                                                    PID:3140
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                    3⤵
                                                      PID:4336
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5903 " | findstr /C:"ESTABLISHED"
                                                      3⤵
                                                        PID:3632
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5902 " | findstr /C:"ESTABLISHED"
                                                        3⤵
                                                          PID:688
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5900 " | findstr /C:"ESTABLISHED"
                                                          3⤵
                                                            PID:5044
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-U8IQC.tmp\cmd.bat""
                                                            3⤵
                                                              PID:2620
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                              3⤵
                                                                PID:4648
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                3⤵
                                                                  PID:2108
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                  3⤵
                                                                    PID:2392
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                    3⤵
                                                                      PID:3268
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
                                                                      3⤵
                                                                        PID:3184
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                        3⤵
                                                                          PID:4704
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                          3⤵
                                                                            PID:400
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                            3⤵
                                                                              PID:2684
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                              3⤵
                                                                                PID:680
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                3⤵
                                                                                  PID:2740
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                  3⤵
                                                                                    PID:2328
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
                                                                                1⤵
                                                                                • Enumerates processes with tasklist
                                                                                PID:3176
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
                                                                                1⤵
                                                                                • Enumerates processes with tasklist
                                                                                PID:3688
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
                                                                                1⤵
                                                                                  PID:3568
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
                                                                                  1⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  PID:2004
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
                                                                                  1⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  PID:3372
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
                                                                                  1⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  PID:1496
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
                                                                                  1⤵
                                                                                    PID:4368
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
                                                                                    1⤵
                                                                                      PID:3332
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:4316
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:3816
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:1668
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:1092
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:1524
                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                      find "PID"
                                                                                      1⤵
                                                                                        PID:2328
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
                                                                                          2⤵
                                                                                            PID:1456
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:5088
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:3784
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:4504
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:1156
                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                          findstr /C:"ESTABLISHED"
                                                                                          1⤵
                                                                                            PID:3696
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                                                                            1⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:3580
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                            1⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1184
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                                                                            1⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:2116
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                            1⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:2620
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-0CTKC.tmp\gentlemjmp_irow.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-0CTKC.tmp\gentlemjmp_irow.tmp" /SL5="$270044,2930134,56832,C:\Users\Admin\AppData\Local\Temp\is-U8IQC.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
                                                                                            1⤵
                                                                                              PID:3176
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-EN9NV.tmp\ex.bat""
                                                                                                2⤵
                                                                                                  PID:4544
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
                                                                                                1⤵
                                                                                                  PID:3184
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "WINDOWTITLE eq Process Monitor*"
                                                                                                    2⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    PID:764
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                                  1⤵
                                                                                                    PID:1864
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                                    1⤵
                                                                                                      PID:3704
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                                                                                      1⤵
                                                                                                        PID:1520
                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                        findstr /C:"ESTABLISHED"
                                                                                                        1⤵
                                                                                                          PID:4720
                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                          findstr /C:":5903 "
                                                                                                          1⤵
                                                                                                            PID:1972
                                                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                            netstat -na
                                                                                                            1⤵
                                                                                                            • Gathers network information
                                                                                                            PID:4552
                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                            findstr /C:":5902 "
                                                                                                            1⤵
                                                                                                              PID:3448
                                                                                                            • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                              netstat -na
                                                                                                              1⤵
                                                                                                              • Gathers network information
                                                                                                              PID:4264
                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                              findstr /C:"ESTABLISHED"
                                                                                                              1⤵
                                                                                                                PID:3176
                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                findstr /C:":5900 "
                                                                                                                1⤵
                                                                                                                  PID:3352
                                                                                                                • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                  netstat -na
                                                                                                                  1⤵
                                                                                                                  • Gathers network information
                                                                                                                  PID:2216
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                                                                                  1⤵
                                                                                                                    PID:856
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                                                                                                                    1⤵
                                                                                                                      PID:736
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                                                                                                      1⤵
                                                                                                                        PID:3480
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                                                                                                        1⤵
                                                                                                                          PID:2728
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                                                                                                                          1⤵
                                                                                                                            PID:728
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                                                                                                                            1⤵
                                                                                                                              PID:2636
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                                                                                                                              1⤵
                                                                                                                                PID:2136
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
                                                                                                                                1⤵
                                                                                                                                  PID:544

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • memory/1184-41-0x0000000073AA0000-0x0000000074250000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/1184-32-0x0000000006840000-0x000000000685E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                • memory/1184-38-0x0000000008AF0000-0x000000000916A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.5MB

                                                                                                                                • memory/1184-15-0x0000000073AA0000-0x0000000074250000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/1184-17-0x0000000005360000-0x0000000005370000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/1184-18-0x00000000059A0000-0x0000000005FC8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.2MB

                                                                                                                                • memory/1184-16-0x0000000005360000-0x0000000005370000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/1184-19-0x0000000005870000-0x0000000005892000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/1184-20-0x0000000006150000-0x00000000061B6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/1184-26-0x00000000061C0000-0x0000000006226000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/1184-31-0x0000000006340000-0x0000000006694000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                • memory/1184-14-0x0000000005270000-0x00000000052A6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  216KB

                                                                                                                                • memory/1184-33-0x0000000006880000-0x00000000068CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/1184-34-0x0000000007800000-0x0000000007896000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  600KB

                                                                                                                                • memory/1184-36-0x0000000006DB0000-0x0000000006DD2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/1184-37-0x0000000007EC0000-0x0000000008464000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.6MB

                                                                                                                                • memory/1184-35-0x0000000006D90000-0x0000000006DAA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  104KB

                                                                                                                                • memory/1664-134-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1664-159-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/1664-158-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/1664-7-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/1664-152-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/2780-156-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/2780-97-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/2780-99-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/3176-104-0x0000000000670000-0x0000000000671000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/3176-117-0x0000000003B50000-0x0000000003B8C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  240KB

                                                                                                                                • memory/3176-153-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/3176-154-0x0000000003B50000-0x0000000003B8C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  240KB

                                                                                                                                • memory/3176-155-0x0000000003D10000-0x0000000003D25000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  84KB

                                                                                                                                • memory/3176-124-0x0000000003D10000-0x0000000003D25000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  84KB

                                                                                                                                • memory/3184-133-0x0000000001060000-0x0000000001070000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/3184-144-0x0000000005EF0000-0x0000000006244000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                • memory/3184-131-0x0000000073110000-0x00000000738C0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3184-148-0x0000000073110000-0x00000000738C0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3184-132-0x0000000001060000-0x0000000001070000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/3184-146-0x0000000006610000-0x000000000665C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/3472-130-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/3472-2-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/3472-0-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/3472-160-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB