3c000dd9e8863ee932f1670e00a7c16a0d80642db06ae9b91dd6c331f0d2fa78

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\javaw.exe -jar \"C:\\Users\\Admin\\Downloads\\svchost-1.0-SNAPSHOT.jar\""	REG.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	installer.exe
File opened for modification	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	installer.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-64.dll	installer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
5840	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\kinit.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\javafx_iio.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\prism_sw.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\blacklist	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\thaidict.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\java8path_target_240713734\java.exe	installer.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\libffi.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\siphash.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\jfxmedia.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\fxplugins.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2ssv.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\jdwp.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\cmm\sRGB.pf	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\dcpr.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\javaws.policy	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages_zh_CN.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\dynalink.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\dt_socket.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\sspi_bridge.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\icu_web.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\zipfs.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\decora_sse.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\i386\jvm.cfg	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\tzdb.dat	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\WindowsAccessBridge-32.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\j2pcsc.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\public_suffix.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\images\cursors\win32_CopyNoDrop32x32.gif	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages_sv.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\policytool.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\gstreamer.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\asm.md	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\java8path_target_240713734\javaws.exe	installer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\sunjce_provider.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\fonts\LucidaSansDemiBold.ttf	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\client\jvm.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\policy\unlimited\local_policy.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\dtplugin\deployJava1.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\psfont.properties.ja	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2native.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\bcel.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\blacklisted.certs	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\images\cursors\win32_MoveDrop32x32.gif	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\java_crw_demo.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\wsdetect.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\lib\images\cursors\win32_MoveNoDrop32x32.gif	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\freebxml.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\xalan.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\dt_shmem.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_491\bin\deploy.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE83B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE89A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e3c8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1DE2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2037.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e3cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e3c4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF073.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF298.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e3cd.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE918.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF21A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF44F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Sun\Java\Deployment\deployment.properties	javaw.exe
File opened for modification	C:\Windows\Installer\MSIE673.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9C6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E31.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e3c4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE73F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF460.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI221E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2454.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE986.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{71024AE4-039E-4CA4-87B4-2F32180491F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF062.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF42F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e3d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2123.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23B6.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LZMA_EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3492	installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4648	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5964	taskkill.exe
1440	taskkill.exe
5212	taskkill.exe
5912	taskkill.exe
4652	taskkill.exe
5692	taskkill.exe
4004	taskkill.exe
4304	taskkill.exe
1596	taskkill.exe
1864	taskkill.exe
4576	taskkill.exe
544	taskkill.exe
6088	taskkill.exe
4960	taskkill.exe
3744	taskkill.exe
3016	taskkill.exe
4764	taskkill.exe
5588	taskkill.exe
5668	taskkill.exe
6128	taskkill.exe
1852	taskkill.exe
5928	taskkill.exe
712	taskkill.exe
3504	taskkill.exe
1472	taskkill.exe
1272	taskkill.exe
5772	taskkill.exe
4668	taskkill.exe
5516	taskkill.exe
2420	taskkill.exe
716	taskkill.exe
3420	taskkill.exe
1668	taskkill.exe
5356	taskkill.exe
2880	taskkill.exe
400	taskkill.exe
5100	taskkill.exe
5428	taskkill.exe
5896	taskkill.exe
3688	taskkill.exe
4720	taskkill.exe
6080	taskkill.exe
5988	taskkill.exe
6060	taskkill.exe
2668	taskkill.exe
468	taskkill.exe
4220	taskkill.exe
2616	taskkill.exe
3464	taskkill.exe
5444	taskkill.exe
5956	taskkill.exe
4620	taskkill.exe
3416	taskkill.exe
3984	taskkill.exe
2404	taskkill.exe
3740	taskkill.exe
2156	taskkill.exe
1732	taskkill.exe
2240	taskkill.exe
2228	taskkill.exe
6132	taskkill.exe
4100	taskkill.exe
5192	taskkill.exe
1192	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\Policy = "3"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppName = "jp2launcher.exe"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	installer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0037-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0357-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0069-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0088-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0187-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0372-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0383-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0239-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_53"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0118-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0327-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0236-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0386-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0229-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0064-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0338-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0234-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_234"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0120-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0230-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0261-ABCDEFFEDCBA}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0102-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBB}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0365-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0466-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_466"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0472-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0182-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0436-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_436"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0074-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0205-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_205"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0389-ABCDEFFEDCBC}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0272-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_272"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0053-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0475-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\JavaSoft\DeploymentProperties	jp2launcher.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0071-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0292-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0396-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBC}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0485-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_485"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0172-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_172"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0470-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_470"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0167-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_167"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0229-ABCDEFFEDCBB}	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0142-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0077-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0325-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0481-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0274-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0497-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_497"	installer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0064-ABCDEFFEDCBA}\INPROCSERVER32	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0057-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0097-ABCDEFFEDCBA}	installer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0170-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_170"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0277-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0138-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0_138"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0138-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_138"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0181-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0087-ABCDEFFEDCBC}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0083-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0233-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_233"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0041-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0192-ABCDEFFEDCBA}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0119-ABCDEFFEDCBC}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0101-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0325-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0490-ABCDEFFEDCBB}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0025-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_25"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0235-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_235"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0325-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}\ = "Java Plug-in 1.5.0_11"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0142-ABCDEFFEDCBA}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0203-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0273-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0343-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_343"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0171-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0224-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_224"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0099-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_99"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0157-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0068-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_68"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0133-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_133"	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0349-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0185-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0423-ABCDEFFEDCBB}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0134-ABCDEFFEDCBC}	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0088-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_88"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0150-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_150"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0166-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_166"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0194-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0381-ABCDEFFEDCBC}	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0204-ABCDEFFEDCBC}\ = "Java Plug-in 1.6.0_204"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0255-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0269-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_269"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0269-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0378-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_378"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0034-ABCDEFFEDCBC}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0210-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0_210"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0118-ABCDEFFEDCBB}	ssvagent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0056-ABCDEFFEDCBB}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0306-ABCDEFFEDCBB}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBA}	installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0228-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0071-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment"	ssvagent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0043-ABCDEFFEDCBC}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0304-ABCDEFFEDCBC}\InprocServer32	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0055-ABCDEFFEDCBA}	ssvagent.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0186-ABCDEFFEDCBB}	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0351-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}	ssvagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0159-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0016-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_16"	installer.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
4512	msiexec.exe
4512	msiexec.exe
644	chrome.exe
644	chrome.exe
5992	javaws.exe
5992	javaws.exe
6008	jp2launcher.exe
6008	jp2launcher.exe
5308	javaws.exe
5308	javaws.exe
5456	jp2launcher.exe
5456	jp2launcher.exe
4512	msiexec.exe
4512	msiexec.exe
4512	msiexec.exe
4512	msiexec.exe
5520	chrome.exe
5520	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	jre-8u491-windows-i586-iftw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe
Token: SeShutdownPrivilege	644	chrome.exe
Token: SeCreatePagefilePrivilege	644	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe
644	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1804	jre-8u491-windows-i586-iftw.exe
1804	jre-8u491-windows-i586-iftw.exe
1804	jre-8u491-windows-i586-iftw.exe
1804	jre-8u491-windows-i586-iftw.exe
6008	jp2launcher.exe
5456	jp2launcher.exe
2432	java.exe
2432	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1204	644	chrome.exe	97
PID 644 wrote to memory of 1460	644	chrome.exe	98
PID 644 wrote to memory of 4648	644	chrome.exe	99
PID 644 wrote to memory of 1460	644	chrome.exe	98
PID 644 wrote to memory of 3940	644	chrome.exe	100
PID 644 wrote to memory of 3940	644	chrome.exe	100
PID 644 wrote to memory of 3552	644	chrome.exe	101
PID 644 wrote to memory of 2772	644	chrome.exe	102
PID 644 wrote to memory of 3552	644	chrome.exe	101
PID 644 wrote to memory of 2772	644	chrome.exe	102
PID 644 wrote to memory of 1332	644	chrome.exe	104
PID 644 wrote to memory of 1332	644	chrome.exe	104
PID 644 wrote to memory of 2804	644	chrome.exe	106
PID 644 wrote to memory of 1720	644	chrome.exe	113
PID 644 wrote to memory of 1720	644	chrome.exe	113
PID 644 wrote to memory of 2764	644	chrome.exe	114
PID 644 wrote to memory of 2764	644	chrome.exe	114
PID 644 wrote to memory of 1784	644	chrome.exe	115
PID 644 wrote to memory of 1784	644	chrome.exe	115
PID 644 wrote to memory of 220	644	chrome.exe	122
PID 644 wrote to memory of 3720	644	chrome.exe	123
PID 3720 wrote to memory of 1804	3720	jre-8u491-windows-i586-iftw.exe	124
PID 644 wrote to memory of 4828	644	chrome.exe	127
PID 644 wrote to memory of 3492	644	chrome.exe	128
PID 644 wrote to memory of 1052	644	chrome.exe	129
PID 1804 wrote to memory of 4672	1804	jre-8u491-windows-i586-iftw.exe	131
PID 1804 wrote to memory of 3676	1804	jre-8u491-windows-i586-iftw.exe	133
PID 4512 wrote to memory of 868	4512	msiexec.exe	136
PID 4512 wrote to memory of 3492	4512	msiexec.exe	137
PID 3492 wrote to memory of 1140	3492	installer.exe	138
PID 3492 wrote to memory of 5992	3492	installer.exe	142
PID 5992 wrote to memory of 6008	5992	javaws.exe	143
PID 3492 wrote to memory of 5308	3492	installer.exe	144
PID 5308 wrote to memory of 5456	5308	javaws.exe	145
PID 4512 wrote to memory of 2612	4512	msiexec.exe	146
PID 4512 wrote to memory of 5164	4512	msiexec.exe	153
PID 4512 wrote to memory of 5240	4512	msiexec.exe	148
PID 4512 wrote to memory of 6024	4512	msiexec.exe	149
PID 4512 wrote to memory of 5196	4512	msiexec.exe	150
PID 1804 wrote to memory of 5532	1804	jre-8u491-windows-i586-iftw.exe	151
PID 644 wrote to memory of 5520	644	chrome.exe	155
PID 644 wrote to memory of 5388	644	chrome.exe	156
PID 644 wrote to memory of 5388	644	chrome.exe	156
PID 644 wrote to memory of 2768	644	chrome.exe	157
PID 644 wrote to memory of 5264	644	chrome.exe	161
PID 644 wrote to memory of 5264	644	chrome.exe	161
PID 3908 wrote to memory of 2344	3908	cmd.exe	165
PID 2344 wrote to memory of 5148	2344	java.exe	166
PID 3908 wrote to memory of 2892	3908	cmd.exe	167
PID 2892 wrote to memory of 4680	2892	java.exe	168
PID 3908 wrote to memory of 5540	3908	cmd.exe	169
PID 5540 wrote to memory of 2432	5540	java.exe	170
PID 2432 wrote to memory of 5620	2432	java.exe	171
PID 2432 wrote to memory of 5840	2432	java.exe	173
PID 2432 wrote to memory of 4720	2432	java.exe	177
PID 2432 wrote to memory of 6112	2432	java.exe	179
PID 2432 wrote to memory of 4620	2432	java.exe	181
PID 2432 wrote to memory of 6080	2432	java.exe	183
PID 2432 wrote to memory of 6060	2432	java.exe	185
PID 2432 wrote to memory of 3416	2432	java.exe	187
PID 2432 wrote to memory of 5272	2432	java.exe	189
PID 2432 wrote to memory of 4764	2432	java.exe	191
PID 2432 wrote to memory of 5964	2432	java.exe	193
PID 2432 wrote to memory of 3984	2432	java.exe	195

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\svchost-1.0-SNAPSHOT.jar
1⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb20ddc728,0x7ffb20ddc734,0x7ffb20ddc740
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,2937241792758587965,11899719507775955438,262144 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,18402755506306197520,3601119709101537478,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,10138069788331733335,16932402730995774756,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,1468652415936489005,14426380281146932155,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,17880593552400155594,10084036017089176328,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,5517795742903730297,277580820367273784,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,5061051305433914962,16767421852715548865,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5616,i,10236157200783073702,8914016952861689076,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3968,i,14016808130595544637,1018401242310178311,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3492,i,16317587869572372224,15610489301714859639,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,2992515168829881631,8281476318153930632,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:220
- C:\Users\Admin\Downloads\jre-8u491-windows-i586-iftw.exe
  "C:\Users\Admin\Downloads\jre-8u491-windows-i586-iftw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\jds240678015.tmp\jre-8u491-windows-i586-iftw.exe
    "C:\Users\Admin\AppData\Local\Temp\jds240678015.tmp\jre-8u491-windows-i586-iftw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\msi.tmp"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4672
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\jre1.8.0_491.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\msi.tmp"
      4⤵
      Executes dropped EXE
      PID:3676
  - - C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe
      -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_491\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,12733383850246150270,2050865733275608676,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,1803167466483279837,11237061174596920916,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,4601645555650395615,11880598561687777787,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3472,i,8731721963081521054,8005940151583249621,262144 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6268,i,14247614688439983164,12181995526106964261,2097152 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,13702550299424117113,8537641152306623529,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,10604076194423686309,170786120630002942,524288 --field-trial-handle=1840,i,13909300980965799107,8498211551390092833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1372

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B05ABBD4BE53236144933CD5B0F4F1C8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:868
- C:\Program Files (x86)\Java\jre1.8.0_491\installer.exe
  "C:\Program Files (x86)\Java\jre1.8.0_491\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_491\\" WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F32180491F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping240678609.tmp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1140
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\ssvagent.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5892
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:6008
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B9E9500ABCE26A7C12B70646603D0BF8 E Global\MSI0000
  2⤵
  PID:2612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E44097BFE0E4E759331ED12C470D1F4
  2⤵
  PID:5164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63CBB4E0BCFD3B1295E0002F7341D0EF E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3D9AC10C35711CC9FBFA69F62AEF0ADB
  2⤵
  PID:6024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 44979F48066F2F83AD2EDBFE905A31D8 E Global\MSI0000
  2⤵
  PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:5164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3332

C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\svchost-1.0-SNAPSHOT.jar"
1⤵
- Executes dropped EXE
PID:6060

C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\svchost-1.0-SNAPSHOT.jar"
1⤵
- Executes dropped EXE
PID:5144

C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\svchost-1.0-SNAPSHOT.jar"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3644

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Common Files\Oracle\Java\java8path\java.exe
  java -ver
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe" -ver
    3⤵
    - Executes dropped EXE
    PID:5148
- C:\Program Files (x86)\Common Files\Oracle\Java\java8path\java.exe
  java -version
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe" -version
    3⤵
    - Executes dropped EXE
    PID:4680
- C:\Program Files (x86)\Common Files\Oracle\Java\java8path\java.exe
  java -cp svchost-1.0-SNAPSHOT.jar windows.system.svchost.Main
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe
    "C:\Program Files (x86)\Java\jre1.8.0_491\bin\java.exe" -cp svchost-1.0-SNAPSHOT.jar windows.system.svchost.Main
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\REG.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "svchost" /t REG_SZ /F /D "C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe -jar \"C:\Users\Admin\Downloads\svchost-1.0-SNAPSHOT.jar\""
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:5620
  - - C:\Windows\SysWOW64\tasklist.exe
      "tasklist.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5840
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 0 | Name: System Idle Process
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4720
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4 | Name: System
      4⤵
      PID:6112
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 92 | Name: Registry
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4620
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 356 | Name: smss.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6080
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 448 | Name: csrss.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6060
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 524 | Name: wininit.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3416
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 532 | Name: csrss.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 620 | Name: winlogon.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 660 | Name: services.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5964
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 668 | Name: lsass.exe
      4⤵
      Kills process with taskkill
      PID:3984
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 788 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2228
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 796 | Name: fontdrvhost.exe
      4⤵
      Kills process with taskkill
      PID:1472
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 804 | Name: fontdrvhost.exe
      4⤵
      Kills process with taskkill
      PID:1440
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 880 | Name: WUDFHost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5212
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 944 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1012 | Name: svchost.exe
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 536 | Name: dwm.exe
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1036 | Name: svchost.exe
      4⤵
      PID:5128
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1120 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1156 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1164 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5588
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1176 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5912
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1216 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5668
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1288 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5988
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1316 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:2668
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1364 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3284
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1404 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1272
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1476 | Name: svchost.exe
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1576 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:2404
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1620 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:4652
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1632 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5692
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1776 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:468
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1840 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5772
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1888 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4004
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1960 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4220
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1968 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2616
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1484 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1848 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4200
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1924 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5356
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2136 | Name: svchost.exe
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2168 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:2880
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2264 | Name: spoolsv.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3740
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2296 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2612
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2324 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:6128
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2468 | Name: svchost.exe
      4⤵
      PID:3324
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2480 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4668
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2644 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1864
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2672 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2692 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3040
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2712 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2784 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:400
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2860 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:4576
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3064 | Name: sihost.exe
      4⤵
      Kills process with taskkill
      PID:2156
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2384 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:544
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2828 | Name: taskhostw.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2680 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5100
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3180 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:6088
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3232 | Name: explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3388 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:4304
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3572 | Name: dllhost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3668 | Name: StartMenuExperienceHost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3728 | Name: RuntimeBroker.exe
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3812 | Name: SearchApp.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5516
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3960 | Name: RuntimeBroker.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1732
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4524 | Name: RuntimeBroker.exe
      4⤵
      Kills process with taskkill
      PID:3464
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3496 | Name: sppsvc.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2624
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4776 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 5068 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:1852
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4116 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5428
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1284 | Name: SppExtComObj.Exe
      4⤵
      PID:3588
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 2684 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:5444
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3036 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4960
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 752 | Name: OfficeClickToRun.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 616 | Name: dllhost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5896
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4968 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3744
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3384 | Name: TextInputHost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5956
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1952 | Name: svchost.exe
      4⤵
      PID:3172
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 764 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:3688
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 644 | Name: chrome.exe
      4⤵
      Kills process with taskkill
      PID:2240
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3760 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6132
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1204 | Name: chrome.exe
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1460 | Name: chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5928
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4648 | Name: chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:712
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3940 | Name: chrome.exe
      4⤵
      PID:5136
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1332 | Name: chrome.exe
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4988 | Name: svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3016
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1720 | Name: chrome.exe
      4⤵
      PID:5184
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3720 | Name: jre-8u491-windows-i586-iftw.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 1804 | Name: jre-8u491-windows-i586-iftw.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 4512 | Name: msiexec.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2420
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 5820 | Name: svchost.exe
      4⤵
      Kills process with taskkill
      PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 5388 | Name: chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3504
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 5264 | Name: chrome.exe
      4⤵
      Kills process with taskkill
      PID:5192
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 3908 | Name: cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:716
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 916 | Name: conhost.exe
      4⤵
      Kills process with taskkill
      PID:3420
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /PID PID: 5540 | Name: java.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery