Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 20:10

General

  • Target

    02a70d502c907e478563fa6151993a57.exe

  • Size

    3.9MB

  • MD5

    02a70d502c907e478563fa6151993a57

  • SHA1

    804f5680f9768efd315b795769b20133b6670b37

  • SHA256

    11f54d505aa0acf95198296fd3017bbee5656ff374f96d4a34cec36c84312aab

  • SHA512

    2ceb29ea9c6b0167606eea56d01510003197d97d340b0e6746e44ec5cced3572ecd2ae8b5074de4ae15c1a2fdca4d11eded7caeaf019c33f6354555b5902ca87

  • SSDEEP

    98304:kVXOCAF7o0ydfx9FV8vQquj/UG0cFQlhG:MXOCA60HC/UG08N

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 21 IoCs
  • Gathers network information 2 TTPs 5 IoCs

    Uses commandline utility to view network configuration.

  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02a70d502c907e478563fa6151993a57.exe
    "C:\Users\Admin\AppData\Local\Temp\02a70d502c907e478563fa6151993a57.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\is-T2F1S.tmp\02a70d502c907e478563fa6151993a57.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-T2F1S.tmp\02a70d502c907e478563fa6151993a57.tmp" /SL5="$1C01D2,3143344,56832,C:\Users\Admin\AppData\Local\Temp\02a70d502c907e478563fa6151993a57.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
          PID:1632
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
          3⤵
            PID:3380
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
              4⤵
                PID:4068
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
              3⤵
                PID:4196
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                3⤵
                  PID:4396
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                  3⤵
                    PID:3092
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                    3⤵
                      PID:4020
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                      3⤵
                        PID:3548
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                          4⤵
                            PID:4340
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5901 " | findstr /C:"ESTABLISHED"
                          3⤵
                            PID:4020
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /C:"ESTABLISHED"
                              4⤵
                                PID:608
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /C:":5901 "
                                4⤵
                                  PID:5104
                                • C:\Windows\SysWOW64\NETSTAT.EXE
                                  netstat -na
                                  4⤵
                                  • Gathers network information
                                  PID:1944
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                                  4⤵
                                    PID:4764
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                  3⤵
                                    PID:3540
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                      4⤵
                                        PID:4256
                                    • C:\Users\Admin\AppData\Local\Temp\is-QJ399.tmp\gentlemjmp_ieu.exe
                                      "C:\Users\Admin\AppData\Local\Temp\is-QJ399.tmp\gentlemjmp_ieu.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\02a70d502c907e478563fa6151993a57.exe
                                      3⤵
                                        PID:4440
                                        • C:\Users\Admin\AppData\Local\Temp\is-LRE2B.tmp\gentlemjmp_ieu.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-LRE2B.tmp\gentlemjmp_ieu.tmp" /SL5="$27002E,2753625,56832,C:\Users\Admin\AppData\Local\Temp\is-QJ399.tmp\gentlemjmp_ieu.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\02a70d502c907e478563fa6151993a57.exe
                                          4⤵
                                            PID:396
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                          3⤵
                                            PID:2716
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                            3⤵
                                              PID:4036
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                              3⤵
                                                PID:3004
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5904 " | findstr /C:"ESTABLISHED"
                                                3⤵
                                                  PID:224
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5903 " | findstr /C:"ESTABLISHED"
                                                  3⤵
                                                    PID:4460
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5902 " | findstr /C:"ESTABLISHED"
                                                    3⤵
                                                      PID:3632
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5900 " | findstr /C:"ESTABLISHED"
                                                      3⤵
                                                        PID:1200
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                                                          4⤵
                                                            PID:4768
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-QJ399.tmp\cmd.bat""
                                                          3⤵
                                                            PID:4400
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                            3⤵
                                                              PID:4992
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                              3⤵
                                                                PID:4336
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                3⤵
                                                                  PID:3792
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                  3⤵
                                                                    PID:3256
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
                                                                    3⤵
                                                                      PID:2568
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                      3⤵
                                                                        PID:1200
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                        3⤵
                                                                          PID:4036
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                          3⤵
                                                                            PID:3280
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                            3⤵
                                                                              PID:1056
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                              3⤵
                                                                                PID:1612
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
                                                                            1⤵
                                                                              PID:3536
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-QJ399.tmp\ex.bat""
                                                                              1⤵
                                                                                PID:2728
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                                                                  2⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  PID:2704
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
                                                                                1⤵
                                                                                • Enumerates processes with tasklist
                                                                                PID:4872
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
                                                                                1⤵
                                                                                • Enumerates processes with tasklist
                                                                                PID:2680
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
                                                                                1⤵
                                                                                  PID:4052
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
                                                                                  1⤵
                                                                                    PID:1956
                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
                                                                                    1⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    PID:2612
                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                    tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
                                                                                    1⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    PID:2716
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                      2⤵
                                                                                        PID:2940
                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                      tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
                                                                                      1⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:4784
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
                                                                                      1⤵
                                                                                        PID:4328
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
                                                                                        1⤵
                                                                                          PID:212
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:3036
                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                          tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
                                                                                          1⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          PID:1504
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
                                                                                          1⤵
                                                                                            PID:4708
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                                                                                            1⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:4520
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                                                                                            1⤵
                                                                                              PID:4940
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                                                                                                2⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:212
                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                              tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                                                                                              1⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              PID:4328
                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                              tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                                                                                              1⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              PID:4068
                                                                                            • C:\Windows\SysWOW64\find.exe
                                                                                              find "PID"
                                                                                              1⤵
                                                                                                PID:960
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:3856
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:4792
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:5080
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:3836
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:5060
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                                1⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:776
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                                                                                1⤵
                                                                                                  PID:2132
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                                                                                    2⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    PID:2784
                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                  tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                                  1⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  PID:3380
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
                                                                                                  1⤵
                                                                                                    PID:4888
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-45Q5U.tmp\ex.bat""
                                                                                                    1⤵
                                                                                                      PID:1972
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                                      1⤵
                                                                                                        PID:1252
                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                        findstr /C:"ESTABLISHED"
                                                                                                        1⤵
                                                                                                          PID:3784
                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                          findstr /C:":5904 "
                                                                                                          1⤵
                                                                                                            PID:2896
                                                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                            netstat -na
                                                                                                            1⤵
                                                                                                            • Gathers network information
                                                                                                            PID:1872
                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                            findstr /C:"ESTABLISHED"
                                                                                                            1⤵
                                                                                                              PID:116
                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                              findstr /C:":5903 "
                                                                                                              1⤵
                                                                                                                PID:4164
                                                                                                              • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                netstat -na
                                                                                                                1⤵
                                                                                                                • Gathers network information
                                                                                                                PID:380
                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                findstr /C:"ESTABLISHED"
                                                                                                                1⤵
                                                                                                                  PID:4800
                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                  findstr /C:":5902 "
                                                                                                                  1⤵
                                                                                                                    PID:4552
                                                                                                                  • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                    netstat -na
                                                                                                                    1⤵
                                                                                                                    • Gathers network information
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3536
                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                    findstr /C:"ESTABLISHED"
                                                                                                                    1⤵
                                                                                                                      PID:4068
                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                      findstr /C:":5900 "
                                                                                                                      1⤵
                                                                                                                        PID:2940
                                                                                                                      • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                        netstat -na
                                                                                                                        1⤵
                                                                                                                        • Gathers network information
                                                                                                                        PID:4388
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                                                                                        1⤵
                                                                                                                          PID:2500
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                                                                                                          1⤵
                                                                                                                            PID:3028
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2728
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                                                                                                                            1⤵
                                                                                                                              PID:5088
                                                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                              tasklist /FI "WINDOWTITLE eq Process Monitor*"
                                                                                                                              1⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:1252
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                                                                                                                              1⤵
                                                                                                                                PID:3964
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
                                                                                                                                1⤵
                                                                                                                                  PID:3848

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • memory/396-102-0x0000000002100000-0x0000000002101000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/396-149-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/396-151-0x0000000003BD0000-0x0000000003BE5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  84KB

                                                                                                                                • memory/396-150-0x0000000003A10000-0x0000000003A4C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  240KB

                                                                                                                                • memory/396-122-0x0000000003BD0000-0x0000000003BE5000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  84KB

                                                                                                                                • memory/396-115-0x0000000003A10000-0x0000000003A4C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  240KB

                                                                                                                                • memory/1044-55-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/1044-0-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/1044-156-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/1044-2-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/3536-35-0x0000000006900000-0x000000000691A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  104KB

                                                                                                                                • memory/3536-41-0x0000000074280000-0x0000000074A30000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3536-32-0x00000000063D0000-0x00000000063EE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                • memory/3536-19-0x0000000005410000-0x0000000005432000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/3536-34-0x00000000073B0000-0x0000000007446000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  600KB

                                                                                                                                • memory/3536-36-0x0000000006950000-0x0000000006972000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                • memory/3536-37-0x0000000007C50000-0x00000000081F4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.6MB

                                                                                                                                • memory/3536-18-0x0000000005620000-0x0000000005C48000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.2MB

                                                                                                                                • memory/3536-38-0x0000000008880000-0x0000000008EFA000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  6.5MB

                                                                                                                                • memory/3536-33-0x0000000006540000-0x000000000658C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/3536-20-0x00000000055B0000-0x0000000005616000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/3536-31-0x0000000005F30000-0x0000000006284000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                • memory/3536-14-0x0000000004E30000-0x0000000004E66000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  216KB

                                                                                                                                • memory/3536-26-0x0000000005DC0000-0x0000000005E26000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                • memory/3536-16-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/3536-15-0x0000000074280000-0x0000000074A30000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/3536-17-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/4416-101-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4416-155-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/4416-154-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/4416-89-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/4416-148-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  756KB

                                                                                                                                • memory/4416-7-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/4440-152-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/4440-94-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/4440-96-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                • memory/4888-144-0x00000000738F0000-0x00000000740A0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB

                                                                                                                                • memory/4888-130-0x00000000051C0000-0x00000000051D0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/4888-140-0x00000000060D0000-0x0000000006424000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  3.3MB

                                                                                                                                • memory/4888-129-0x00000000051C0000-0x00000000051D0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                • memory/4888-142-0x00000000066B0000-0x00000000066FC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  304KB

                                                                                                                                • memory/4888-128-0x00000000738F0000-0x00000000740A0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.7MB