Analysis
-
max time kernel
92s -
max time network
152s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 12:47
General
-
Target
PI.exe
-
Size
339KB
-
MD5
e9b130e7262d0aafa2c0ba84d28539dd
-
SHA1
5e799f43441bd288094370b03bdfa554eafb6324
-
SHA256
dd668abafa9cbdf937e710f2e2e7f6228ca99c7a226b507d43f887c03dff8509
-
SHA512
7e934097fbd3e1500c7810794c1fda4267aa64d70197d0623c6dca5f2e91d67960d5e11ec87cfa853c457b5342eebb4d7fc98d5892efd7ad239a32211f0322b5
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://45.95.168.162/city/index.php
Signatures
-
Suspicious use of AdjustPrivilegeToken 145 IoCs
-
Suspicious behavior: EnumeratesProcesses 47638 IoCs
-
Loads dropped DLL 137 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Checks for installed software on the system 1 TTPs 992 IoCs
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious behavior: MapViewOfSection 187 IoCs
-
Suspicious use of SetThreadContext 146 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Delays execution with timeout.exe 32 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 2212 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"8⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"9⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"11⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 312⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"10⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"10⤵
-
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature: /caller-name:mscoreei.dll11⤵
-
C:\Windows\System32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature: /caller-name:mscoreei.dll12⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"11⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 312⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"12⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 313⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"13⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 314⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"14⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 315⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"15⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 316⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"16⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 317⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"18⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 319⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"17⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 318⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"18⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 319⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"19⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 320⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"20⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 321⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"22⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 323⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"21⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 322⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"22⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 323⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"23⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 324⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"25⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 326⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"24⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 325⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"25⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 326⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"26⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 327⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"27⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 328⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"28⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 329⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"29⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 330⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"30⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 331⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"32⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 333⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"31⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 332⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"32⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 333⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"33⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 334⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"34⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 335⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"35⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 336⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"36⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 337⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"37⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 338⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"38⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 339⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"40⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 341⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"39⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 340⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"40⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 341⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"41⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 342⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"42⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 343⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"44⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 345⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"43⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 344⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"44⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 345⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"45⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 346⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"46⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 347⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"47⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 348⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"48⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 349⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"49⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 350⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"51⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 352⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"50⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 351⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"51⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 352⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"52⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 353⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"53⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 354⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"55⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 356⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"54⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 355⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"55⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 356⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"56⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 357⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"57⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 358⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"58⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 359⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"59⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 360⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"60⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 361⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"62⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 363⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"61⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 362⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"62⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 363⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"63⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 364⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"64⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 365⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"66⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 367⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"65⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 366⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"66⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 367⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"67⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 368⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"68⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 369⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"70⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 371⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"69⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 370⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"70⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 371⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"71⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 372⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"73⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 374⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"72⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 373⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"73⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 374⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"74⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 375⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"75⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 376⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"76⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 377⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"77⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 378⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"78⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 379⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"79⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 380⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"81⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 382⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"80⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 381⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"81⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 382⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"82⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 383⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"84⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 385⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"83⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 384⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"84⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 385⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"85⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 386⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"87⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 388⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"86⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 387⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"87⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 388⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"88⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 389⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"89⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 390⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"90⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 391⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"91⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 392⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"93⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 394⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"92⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 393⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"93⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 394⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"94⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 395⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"96⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 397⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"95⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 396⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"96⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 397⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"97⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 398⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"98⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 399⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"100⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3101⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"99⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3100⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"100⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3101⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"101⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3102⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"103⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3104⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"102⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3103⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"103⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3104⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"104⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3105⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"106⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3107⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"105⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3106⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"106⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3107⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"107⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3108⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"108⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3109⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"109⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3110⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"110⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3111⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"111⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3112⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"113⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3114⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"112⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3113⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"113⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3114⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"114⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3115⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"116⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3117⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"115⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3116⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"116⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3117⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"117⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3118⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"119⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3120⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"118⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3119⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"119⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3120⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"120⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3121⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"121⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3122⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"123⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3124⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"122⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3123⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"123⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3124⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"124⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3125⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"126⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3127⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"125⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3126⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"126⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3127⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"127⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3128⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"129⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3130⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"128⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3129⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"129⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3130⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"130⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3131⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"132⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3133⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"131⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3132⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"132⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3133⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"133⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3134⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"134⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3135⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"136⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3137⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"135⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3136⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"136⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3137⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"137⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3138⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"138⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3139⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
- Checks processor information in registry
- Checks for installed software on the system
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"140⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3141⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"139⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3140⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"140⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3141⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"141⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3142⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "RegAsm.exe"143⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 3144⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"142⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3143⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"143⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3144⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"144⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3145⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"145⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3146⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\PI.exe"146⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 3147⤵
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
C:\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
memory/60-258-0x000000000041A1F8-mapping.dmp
-
memory/60-1940-0x0000000000000000-mapping.dmp
-
memory/64-1276-0x0000000000000000-mapping.dmp
-
memory/64-1459-0x000000000041A1F8-mapping.dmp
-
memory/64-817-0x0000000000000000-mapping.dmp
-
memory/296-1218-0x000000000041A1F8-mapping.dmp
-
memory/296-5-0x0000000000000000-mapping.dmp
-
memory/548-1042-0x0000000000000000-mapping.dmp
-
memory/684-1740-0x0000000000000000-mapping.dmp
-
memory/684-1226-0x000000000041A1F8-mapping.dmp
-
memory/736-1251-0x000000000041A1F8-mapping.dmp
-
memory/736-1523-0x0000000000000000-mapping.dmp
-
memory/744-779-0x0000000000000000-mapping.dmp
-
memory/744-20-0x0000000000000000-mapping.dmp
-
memory/744-1216-0x0000000000000000-mapping.dmp
-
memory/756-250-0x0000000000000000-mapping.dmp
-
memory/936-757-0x0000000000000000-mapping.dmp
-
memory/936-301-0x0000000000000000-mapping.dmp
-
memory/952-1498-0x0000000000000000-mapping.dmp
-
memory/952-1778-0x0000000000000000-mapping.dmp
-
memory/952-835-0x0000000000000000-mapping.dmp
-
memory/992-673-0x0000000000000000-mapping.dmp
-
memory/996-531-0x0000000000000000-mapping.dmp
-
memory/1012-1277-0x0000000000000000-mapping.dmp
-
memory/1012-1695-0x000000000041A1F8-mapping.dmp
-
memory/1016-1667-0x0000000000000000-mapping.dmp
-
memory/1100-1449-0x000000000041A1F8-mapping.dmp
-
memory/1100-983-0x0000000000000000-mapping.dmp
-
memory/1112-1915-0x0000000000000000-mapping.dmp
-
memory/1112-318-0x0000000000000000-mapping.dmp
-
memory/1136-1754-0x0000000000000000-mapping.dmp
-
memory/1136-438-0x0000000000000000-mapping.dmp
-
memory/1136-819-0x0000000000000000-mapping.dmp
-
memory/1136-1228-0x0000000000000000-mapping.dmp
-
memory/1152-1901-0x0000000000000000-mapping.dmp
-
memory/1152-502-0x0000000000000000-mapping.dmp
-
memory/1168-26-0x0000000000000000-mapping.dmp
-
memory/1168-630-0x0000000000000000-mapping.dmp
-
memory/1168-297-0x0000000000000000-mapping.dmp
-
memory/1188-155-0x0000000000000000-mapping.dmp
-
memory/1200-841-0x0000000000000000-mapping.dmp
-
memory/1200-663-0x0000000000000000-mapping.dmp
-
memory/1208-1926-0x0000000000000000-mapping.dmp
-
memory/1208-1173-0x0000000000000000-mapping.dmp
-
memory/1208-1604-0x0000000000000000-mapping.dmp
-
memory/1216-1515-0x0000000000000000-mapping.dmp
-
memory/1228-504-0x0000000000000000-mapping.dmp
-
memory/1248-821-0x000000000041A1F8-mapping.dmp
-
memory/1300-1488-0x0000000000000000-mapping.dmp
-
memory/1320-49-0x0000000000000000-mapping.dmp
-
memory/1332-1665-0x000000000041A1F8-mapping.dmp
-
memory/1332-1935-0x0000000000000000-mapping.dmp
-
memory/1336-842-0x0000000000000000-mapping.dmp
-
memory/1336-645-0x0000000000000000-mapping.dmp
-
memory/1348-1215-0x0000000000000000-mapping.dmp
-
memory/1380-840-0x0000000000000000-mapping.dmp
-
memory/1396-1872-0x0000000000000000-mapping.dmp
-
memory/1404-374-0x000000000041A1F8-mapping.dmp
-
memory/1408-147-0x0000000000000000-mapping.dmp
-
memory/1416-593-0x0000000000000000-mapping.dmp
-
memory/1436-23-0x000000000041A1F8-mapping.dmp
-
memory/1444-1407-0x0000000000000000-mapping.dmp
-
memory/1448-135-0x0000000000000000-mapping.dmp
-
memory/1480-1893-0x0000000000000000-mapping.dmp
-
memory/1532-474-0x0000000000000000-mapping.dmp
-
memory/1532-1936-0x0000000000000000-mapping.dmp
-
memory/1536-1469-0x0000000000000000-mapping.dmp
-
memory/1536-1834-0x0000000000000000-mapping.dmp
-
memory/1568-1938-0x000000000041A1F8-mapping.dmp
-
memory/1568-1443-0x000000000041A1F8-mapping.dmp
-
memory/1628-289-0x0000000000000000-mapping.dmp
-
memory/1632-679-0x0000000000000000-mapping.dmp
-
memory/1648-1795-0x0000000000000000-mapping.dmp
-
memory/1648-1508-0x0000000000000000-mapping.dmp
-
memory/1648-444-0x000000000041A1F8-mapping.dmp
-
memory/1648-1698-0x0000000000000000-mapping.dmp
-
memory/1648-145-0x0000000000000000-mapping.dmp
-
memory/1652-296-0x0000000000000000-mapping.dmp
-
memory/1652-1520-0x0000000000000000-mapping.dmp
-
memory/1660-280-0x0000000000000000-mapping.dmp
-
memory/1660-1621-0x0000000000000000-mapping.dmp
-
memory/1720-1768-0x000000000041A1F8-mapping.dmp
-
memory/1724-1493-0x000000000041A1F8-mapping.dmp
-
memory/1736-492-0x0000000000000000-mapping.dmp
-
memory/1736-1405-0x0000000000000000-mapping.dmp
-
memory/1736-1821-0x0000000000000000-mapping.dmp
-
memory/1736-745-0x0000000000000000-mapping.dmp
-
memory/1752-1791-0x000000000041A1F8-mapping.dmp
-
memory/1752-1058-0x0000000000000000-mapping.dmp
-
memory/1788-287-0x000000000041A1F8-mapping.dmp
-
memory/1804-1848-0x0000000000000000-mapping.dmp
-
memory/1844-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1844-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1844-985-0x0000000000000000-mapping.dmp
-
memory/1844-1655-0x0000000000000000-mapping.dmp
-
memory/1844-1072-0x0000000000000000-mapping.dmp
-
memory/1844-1777-0x0000000000000000-mapping.dmp
-
memory/1844-1243-0x000000000041A1F8-mapping.dmp
-
memory/1844-1-0x000000000041A1F8-mapping.dmp
-
memory/1876-1876-0x0000000000000000-mapping.dmp
-
memory/1876-635-0x0000000000000000-mapping.dmp
-
memory/1876-977-0x0000000000000000-mapping.dmp
-
memory/1884-150-0x000000000041A1F8-mapping.dmp
-
memory/1924-1837-0x0000000000000000-mapping.dmp
-
memory/1924-497-0x0000000000000000-mapping.dmp
-
memory/1936-283-0x0000000000000000-mapping.dmp
-
memory/1972-1703-0x0000000000000000-mapping.dmp
-
memory/1972-928-0x0000000000000000-mapping.dmp
-
memory/1972-494-0x000000000041A1F8-mapping.dmp
-
memory/1972-1275-0x0000000000000000-mapping.dmp
-
memory/1976-1078-0x000000000041A1F8-mapping.dmp
-
memory/1976-674-0x0000000000000000-mapping.dmp
-
memory/1980-1880-0x0000000000000000-mapping.dmp
-
memory/2032-1716-0x0000000000000000-mapping.dmp
-
memory/2036-994-0x000000000041A1F8-mapping.dmp
-
memory/2052-1871-0x0000000000000000-mapping.dmp
-
memory/2052-270-0x0000000000000000-mapping.dmp
-
memory/2068-1746-0x0000000000000000-mapping.dmp
-
memory/2072-662-0x000000000041A1F8-mapping.dmp
-
memory/2072-483-0x0000000000000000-mapping.dmp
-
memory/2076-677-0x000000000041A1F8-mapping.dmp
-
memory/2084-667-0x0000000000000000-mapping.dmp
-
memory/2084-3-0x0000000000000000-mapping.dmp
-
memory/2084-171-0x0000000000000000-mapping.dmp
-
memory/2160-845-0x000000000041A1F8-mapping.dmp
-
memory/2168-139-0x0000000000000000-mapping.dmp
-
memory/2168-1843-0x000000000041A1F8-mapping.dmp
-
memory/2216-1879-0x0000000000000000-mapping.dmp
-
memory/2216-1246-0x0000000000000000-mapping.dmp
-
memory/2216-1748-0x0000000000000000-mapping.dmp
-
memory/2216-1502-0x0000000000000000-mapping.dmp
-
memory/2220-666-0x0000000000000000-mapping.dmp
-
memory/2220-1525-0x000000000041A1F8-mapping.dmp
-
memory/2220-25-0x0000000000000000-mapping.dmp
-
memory/2224-154-0x0000000000000000-mapping.dmp
-
memory/2252-1433-0x0000000000000000-mapping.dmp
-
memory/2252-299-0x000000000041A1F8-mapping.dmp
-
memory/2252-314-0x0000000000000000-mapping.dmp
-
memory/2280-302-0x0000000000000000-mapping.dmp
-
memory/2300-236-0x0000000000000000-mapping.dmp
-
memory/2300-1410-0x0000000000000000-mapping.dmp
-
memory/2300-1803-0x0000000000000000-mapping.dmp
-
memory/2388-1270-0x0000000000000000-mapping.dmp
-
memory/2396-653-0x000000000041A1F8-mapping.dmp
-
memory/2416-1846-0x0000000000000000-mapping.dmp
-
memory/2496-1891-0x0000000000000000-mapping.dmp
-
memory/2496-1146-0x0000000000000000-mapping.dmp
-
memory/2496-410-0x000000000041A1F8-mapping.dmp
-
memory/2504-1714-0x0000000000000000-mapping.dmp
-
memory/2504-1470-0x0000000000000000-mapping.dmp
-
memory/2532-1771-0x0000000000000000-mapping.dmp
-
memory/2532-1539-0x0000000000000000-mapping.dmp
-
memory/2624-1413-0x000000000041A1F8-mapping.dmp
-
memory/2628-1452-0x0000000000000000-mapping.dmp
-
memory/2668-4-0x0000000000000000-mapping.dmp
-
memory/2672-214-0x0000000000000000-mapping.dmp
-
memory/2672-837-0x000000000041A1F8-mapping.dmp
-
memory/2676-1104-0x0000000000000000-mapping.dmp
-
memory/2676-1518-0x000000000041A1F8-mapping.dmp
-
memory/2684-1260-0x0000000000000000-mapping.dmp
-
memory/2684-29-0x000000000041A1F8-mapping.dmp
-
memory/2708-1744-0x000000000041A1F8-mapping.dmp
-
memory/2760-1457-0x0000000000000000-mapping.dmp
-
memory/2760-303-0x0000000000000000-mapping.dmp
-
memory/2768-127-0x000000000041A1F8-mapping.dmp
-
memory/2784-1164-0x0000000000000000-mapping.dmp
-
memory/2808-31-0x0000000000000000-mapping.dmp
-
memory/2836-189-0x000000000041A1F8-mapping.dmp
-
memory/2836-276-0x0000000000000000-mapping.dmp
-
memory/2840-1719-0x000000000041A1F8-mapping.dmp
-
memory/2840-482-0x0000000000000000-mapping.dmp
-
memory/2860-1942-0x0000000000000000-mapping.dmp
-
memory/2876-1082-0x0000000000000000-mapping.dmp
-
memory/2876-825-0x0000000000000000-mapping.dmp
-
memory/2876-309-0x000000000041A1F8-mapping.dmp
-
memory/2880-1814-0x0000000000000000-mapping.dmp
-
memory/2880-112-0x0000000000000000-mapping.dmp
-
memory/2944-1406-0x0000000000000000-mapping.dmp
-
memory/2964-1528-0x0000000000000000-mapping.dmp
-
memory/2964-1764-0x0000000000000000-mapping.dmp
-
memory/2964-284-0x0000000000000000-mapping.dmp
-
memory/2968-484-0x0000000000000000-mapping.dmp
-
memory/2968-1699-0x0000000000000000-mapping.dmp
-
memory/3044-997-0x0000000000000000-mapping.dmp
-
memory/3044-293-0x000000000041A1F8-mapping.dmp
-
memory/3044-1086-0x0000000000000000-mapping.dmp
-
memory/3228-848-0x0000000000000000-mapping.dmp
-
memory/3228-316-0x000000000041A1F8-mapping.dmp
-
memory/3248-203-0x0000000000000000-mapping.dmp
-
memory/3248-686-0x0000000000000000-mapping.dmp
-
memory/3252-121-0x0000000000000000-mapping.dmp
-
memory/3256-1683-0x0000000000000000-mapping.dmp
-
memory/3256-141-0x000000000041A1F8-mapping.dmp
-
memory/3256-1234-0x0000000000000000-mapping.dmp
-
memory/3256-1409-0x0000000000000000-mapping.dmp
-
memory/3256-1933-0x0000000000000000-mapping.dmp
-
memory/3324-1477-0x0000000000000000-mapping.dmp
-
memory/3324-651-0x0000000000000000-mapping.dmp
-
memory/3324-1419-0x000000000041A1F8-mapping.dmp
-
memory/3356-21-0x0000000000000000-mapping.dmp
-
memory/3368-1903-0x0000000000000000-mapping.dmp
-
memory/3372-17-0x0000000000000000-mapping.dmp
-
memory/3372-153-0x0000000000000000-mapping.dmp
-
memory/3376-1681-0x000000000041A1F8-mapping.dmp
-
memory/3384-1052-0x0000000000000000-mapping.dmp
-
memory/3384-1000-0x000000000041A1F8-mapping.dmp
-
memory/3384-84-0x0000000000000000-mapping.dmp
-
memory/3384-793-0x0000000000000000-mapping.dmp
-
memory/3484-1018-0x0000000000000000-mapping.dmp
-
memory/3484-647-0x000000000041A1F8-mapping.dmp
-
memory/3544-1060-0x000000000041A1F8-mapping.dmp
-
memory/3544-1796-0x0000000000000000-mapping.dmp
-
memory/3584-137-0x0000000000000000-mapping.dmp
-
memory/3584-701-0x0000000000000000-mapping.dmp
-
memory/3584-1021-0x0000000000000000-mapping.dmp
-
memory/3584-1440-0x0000000000000000-mapping.dmp
-
memory/3588-55-0x000000000041A1F8-mapping.dmp
-
memory/3588-669-0x0000000000000000-mapping.dmp
-
memory/3588-460-0x0000000000000000-mapping.dmp
-
memory/3588-1752-0x0000000000000000-mapping.dmp
-
memory/3596-285-0x0000000000000000-mapping.dmp
-
memory/3596-312-0x0000000000000000-mapping.dmp
-
memory/3604-491-0x0000000000000000-mapping.dmp
-
memory/3604-136-0x0000000000000000-mapping.dmp
-
memory/3612-1084-0x000000000041A1F8-mapping.dmp
-
memory/3612-1222-0x0000000000000000-mapping.dmp
-
memory/3624-33-0x0000000000000000-mapping.dmp
-
memory/3624-1820-0x0000000000000000-mapping.dmp
-
memory/3632-1715-0x0000000000000000-mapping.dmp
-
memory/3652-1421-0x0000000000000000-mapping.dmp
-
memory/3652-1697-0x0000000000000000-mapping.dmp
-
memory/3652-277-0x0000000000000000-mapping.dmp
-
memory/3688-279-0x000000000041A1F8-mapping.dmp
-
memory/3688-1671-0x000000000041A1F8-mapping.dmp
-
memory/3700-1265-0x0000000000000000-mapping.dmp
-
memory/3700-146-0x0000000000000000-mapping.dmp
-
memory/3732-1654-0x0000000000000000-mapping.dmp
-
memory/3736-1081-0x0000000000000000-mapping.dmp
-
memory/3736-1522-0x0000000000000000-mapping.dmp
-
memory/3740-857-0x000000000041A1F8-mapping.dmp
-
memory/3740-1747-0x0000000000000000-mapping.dmp
-
memory/3744-1245-0x0000000000000000-mapping.dmp
-
memory/3744-98-0x0000000000000000-mapping.dmp
-
memory/3748-1888-0x000000000041A1F8-mapping.dmp
-
memory/3748-1722-0x0000000000000000-mapping.dmp
-
memory/3748-27-0x0000000000000000-mapping.dmp
-
memory/3760-311-0x0000000000000000-mapping.dmp
-
memory/3760-659-0x0000000000000000-mapping.dmp
-
memory/3760-849-0x0000000000000000-mapping.dmp
-
memory/3792-182-0x0000000000000000-mapping.dmp
-
memory/3792-824-0x0000000000000000-mapping.dmp
-
memory/3792-1516-0x0000000000000000-mapping.dmp
-
memory/3796-1818-0x000000000041A1F8-mapping.dmp
-
memory/3800-1223-0x0000000000000000-mapping.dmp
-
memory/3800-1855-0x0000000000000000-mapping.dmp
-
memory/3804-1567-0x0000000000000000-mapping.dmp
-
memory/3804-1323-0x000000000041A1F8-mapping.dmp
-
memory/3816-1721-0x0000000000000000-mapping.dmp
-
memory/3816-1186-0x000000000041A1F8-mapping.dmp
-
memory/3816-235-0x0000000000000000-mapping.dmp
-
memory/3816-313-0x0000000000000000-mapping.dmp
-
memory/3816-641-0x000000000041A1F8-mapping.dmp
-
memory/3816-1398-0x000000000041A1F8-mapping.dmp
-
memory/3820-853-0x0000000000000000-mapping.dmp
-
memory/3820-1427-0x0000000000000000-mapping.dmp
-
memory/3824-216-0x0000000000000000-mapping.dmp
-
memory/3824-1794-0x0000000000000000-mapping.dmp
-
memory/3832-10-0x0000000000000000-mapping.dmp
-
memory/3852-1224-0x0000000000000000-mapping.dmp
-
memory/3852-138-0x0000000000000000-mapping.dmp
-
memory/3852-290-0x0000000000000000-mapping.dmp
-
memory/3860-1446-0x0000000000000000-mapping.dmp
-
memory/3860-1921-0x0000000000000000-mapping.dmp
-
memory/3864-425-0x0000000000000000-mapping.dmp
-
memory/3868-11-0x0000000000000000-mapping.dmp
-
memory/3872-470-0x0000000000000000-mapping.dmp
-
memory/3876-1014-0x0000000000000000-mapping.dmp
-
memory/3880-424-0x0000000000000000-mapping.dmp
-
memory/3880-808-0x0000000000000000-mapping.dmp
-
memory/3908-1495-0x0000000000000000-mapping.dmp
-
memory/3908-222-0x000000000041A1F8-mapping.dmp
-
memory/3908-161-0x000000000041A1F8-mapping.dmp
-
memory/3924-1432-0x0000000000000000-mapping.dmp
-
memory/3924-275-0x0000000000000000-mapping.dmp
-
memory/3928-1365-0x0000000000000000-mapping.dmp
-
memory/3928-812-0x0000000000000000-mapping.dmp
-
memory/3932-319-0x0000000000000000-mapping.dmp
-
memory/3952-1489-0x0000000000000000-mapping.dmp
-
memory/3952-1002-0x0000000000000000-mapping.dmp
-
memory/3952-490-0x0000000000000000-mapping.dmp
-
memory/3952-68-0x0000000000000000-mapping.dmp
-
memory/3972-144-0x0000000000000000-mapping.dmp
-
memory/3996-143-0x0000000000000000-mapping.dmp
-
memory/3996-13-0x000000000041A1F8-mapping.dmp
-
memory/4004-291-0x0000000000000000-mapping.dmp
-
memory/4024-843-0x0000000000000000-mapping.dmp
-
memory/4028-1263-0x000000000041A1F8-mapping.dmp
-
memory/4028-978-0x0000000000000000-mapping.dmp
-
memory/4028-152-0x0000000000000000-mapping.dmp
-
memory/4032-403-0x0000000000000000-mapping.dmp
-
memory/4032-1863-0x000000000041A1F8-mapping.dmp
-
memory/4032-282-0x0000000000000000-mapping.dmp
-
memory/4044-1750-0x000000000041A1F8-mapping.dmp
-
memory/4044-781-0x0000000000000000-mapping.dmp
-
memory/4048-680-0x0000000000000000-mapping.dmp
-
memory/4048-1257-0x000000000041A1F8-mapping.dmp
-
memory/4048-9-0x0000000000000000-mapping.dmp
-
memory/4048-1772-0x0000000000000000-mapping.dmp
-
memory/4048-984-0x0000000000000000-mapping.dmp
-
memory/4052-1043-0x0000000000000000-mapping.dmp
-
memory/4052-1506-0x000000000041A1F8-mapping.dmp
-
memory/4056-990-0x0000000000000000-mapping.dmp
-
memory/4056-295-0x0000000000000000-mapping.dmp
-
memory/4060-92-0x000000000041A1F8-mapping.dmp
-
memory/4060-1476-0x0000000000000000-mapping.dmp
-
memory/4060-7-0x000000000041A1F8-mapping.dmp
-
memory/4064-1378-0x0000000000000000-mapping.dmp
-
memory/4064-1753-0x0000000000000000-mapping.dmp
-
memory/4064-148-0x0000000000000000-mapping.dmp
-
memory/4100-1283-0x0000000000000000-mapping.dmp
-
memory/4100-367-0x0000000000000000-mapping.dmp
-
memory/4100-561-0x0000000000000000-mapping.dmp
-
memory/4104-1067-0x0000000000000000-mapping.dmp
-
memory/4104-1801-0x0000000000000000-mapping.dmp
-
memory/4112-650-0x0000000000000000-mapping.dmp
-
memory/4112-1117-0x0000000000000000-mapping.dmp
-
memory/4112-1411-0x0000000000000000-mapping.dmp
-
memory/4116-681-0x0000000000000000-mapping.dmp
-
memory/4116-1465-0x0000000000000000-mapping.dmp
-
memory/4116-1548-0x0000000000000000-mapping.dmp
-
memory/4124-961-0x0000000000000000-mapping.dmp
-
memory/4124-631-0x0000000000000000-mapping.dmp
-
memory/4132-1329-0x0000000000000000-mapping.dmp
-
memory/4136-320-0x0000000000000000-mapping.dmp
-
memory/4136-1899-0x000000000041A1F8-mapping.dmp
-
memory/4144-387-0x0000000000000000-mapping.dmp
-
memory/4144-1284-0x0000000000000000-mapping.dmp
-
memory/4144-1741-0x0000000000000000-mapping.dmp
-
memory/4152-1230-0x0000000000000000-mapping.dmp
-
memory/4156-1235-0x0000000000000000-mapping.dmp
-
memory/4160-1878-0x0000000000000000-mapping.dmp
-
memory/4160-982-0x0000000000000000-mapping.dmp
-
memory/4164-1788-0x0000000000000000-mapping.dmp
-
memory/4164-321-0x0000000000000000-mapping.dmp
-
memory/4168-1504-0x0000000000000000-mapping.dmp
-
memory/4172-1807-0x0000000000000000-mapping.dmp
-
memory/4172-1445-0x0000000000000000-mapping.dmp
-
memory/4176-1221-0x0000000000000000-mapping.dmp
-
memory/4180-1050-0x0000000000000000-mapping.dmp
-
memory/4184-1773-0x0000000000000000-mapping.dmp
-
memory/4184-1684-0x0000000000000000-mapping.dmp
-
memory/4192-1708-0x0000000000000000-mapping.dmp
-
memory/4196-638-0x0000000000000000-mapping.dmp
-
memory/4196-323-0x000000000041A1F8-mapping.dmp
-
memory/4200-1877-0x0000000000000000-mapping.dmp
-
memory/4200-1447-0x0000000000000000-mapping.dmp
-
memory/4200-1521-0x0000000000000000-mapping.dmp
-
memory/4204-1340-0x0000000000000000-mapping.dmp
-
memory/4216-1278-0x0000000000000000-mapping.dmp
-
memory/4220-1220-0x0000000000000000-mapping.dmp
-
memory/4220-1013-0x0000000000000000-mapping.dmp
-
memory/4220-1441-0x0000000000000000-mapping.dmp
-
memory/4224-1435-0x0000000000000000-mapping.dmp
-
memory/4228-1272-0x0000000000000000-mapping.dmp
-
memory/4228-1902-0x0000000000000000-mapping.dmp
-
memory/4228-1823-0x0000000000000000-mapping.dmp
-
memory/4232-1874-0x000000000041A1F8-mapping.dmp
-
memory/4232-998-0x0000000000000000-mapping.dmp
-
memory/4232-1066-0x0000000000000000-mapping.dmp
-
memory/4236-1294-0x0000000000000000-mapping.dmp
-
memory/4236-763-0x000000000041A1F8-mapping.dmp
-
memory/4236-1527-0x0000000000000000-mapping.dmp
-
memory/4240-1660-0x0000000000000000-mapping.dmp
-
memory/4240-968-0x0000000000000000-mapping.dmp
-
memory/4244-1010-0x000000000041A1F8-mapping.dmp
-
memory/4248-325-0x0000000000000000-mapping.dmp
-
memory/4248-1201-0x0000000000000000-mapping.dmp
-
memory/4252-1916-0x0000000000000000-mapping.dmp
-
memory/4260-511-0x0000000000000000-mapping.dmp
-
memory/4264-1829-0x0000000000000000-mapping.dmp
-
memory/4268-1727-0x0000000000000000-mapping.dmp
-
memory/4268-1828-0x0000000000000000-mapping.dmp
-
memory/4276-687-0x0000000000000000-mapping.dmp
-
memory/4276-991-0x0000000000000000-mapping.dmp
-
memory/4280-879-0x000000000041A1F8-mapping.dmp
-
memory/4288-1630-0x0000000000000000-mapping.dmp
-
memory/4288-1195-0x0000000000000000-mapping.dmp
-
memory/4288-636-0x0000000000000000-mapping.dmp
-
memory/4292-640-0x0000000000000000-mapping.dmp
-
memory/4292-500-0x000000000041A1F8-mapping.dmp
-
memory/4292-1728-0x0000000000000000-mapping.dmp
-
memory/4292-326-0x0000000000000000-mapping.dmp
-
memory/4292-1044-0x0000000000000000-mapping.dmp
-
memory/4304-1865-0x0000000000000000-mapping.dmp
-
memory/4304-1789-0x0000000000000000-mapping.dmp
-
memory/4304-931-0x0000000000000000-mapping.dmp
-
memory/4304-1712-0x000000000041A1F8-mapping.dmp
-
memory/4308-1037-0x0000000000000000-mapping.dmp
-
memory/4308-1738-0x0000000000000000-mapping.dmp
-
memory/4316-498-0x0000000000000000-mapping.dmp
-
memory/4320-992-0x0000000000000000-mapping.dmp
-
memory/4320-327-0x0000000000000000-mapping.dmp
-
memory/4320-1847-0x0000000000000000-mapping.dmp
-
memory/4328-1008-0x0000000000000000-mapping.dmp
-
memory/4332-580-0x000000000041A1F8-mapping.dmp
-
memory/4340-479-0x000000000041A1F8-mapping.dmp
-
memory/4344-1687-0x0000000000000000-mapping.dmp
-
memory/4344-1917-0x0000000000000000-mapping.dmp
-
memory/4352-329-0x000000000041A1F8-mapping.dmp
-
memory/4352-1816-0x0000000000000000-mapping.dmp
-
memory/4356-1020-0x0000000000000000-mapping.dmp
-
memory/4356-1281-0x000000000041A1F8-mapping.dmp
-
memory/4360-1805-0x000000000041A1F8-mapping.dmp
-
memory/4368-1273-0x000000000041A1F8-mapping.dmp
-
memory/4368-1463-0x0000000000000000-mapping.dmp
-
memory/4368-1046-0x0000000000000000-mapping.dmp
-
memory/4376-1038-0x0000000000000000-mapping.dmp
-
memory/4384-1822-0x0000000000000000-mapping.dmp
-
memory/4388-1731-0x000000000041A1F8-mapping.dmp
-
memory/4388-988-0x000000000041A1F8-mapping.dmp
-
memory/4392-1056-0x0000000000000000-mapping.dmp
-
memory/4392-1236-0x0000000000000000-mapping.dmp
-
memory/4396-1287-0x000000000041A1F8-mapping.dmp
-
memory/4396-1434-0x0000000000000000-mapping.dmp
-
memory/4404-1255-0x0000000000000000-mapping.dmp
-
memory/4404-481-0x0000000000000000-mapping.dmp
-
memory/4408-1886-0x0000000000000000-mapping.dmp
-
memory/4408-1661-0x0000000000000000-mapping.dmp
-
memory/4408-1825-0x000000000041A1F8-mapping.dmp
-
memory/4412-829-0x0000000000000000-mapping.dmp
-
memory/4416-1711-0x0000000000000000-mapping.dmp
-
memory/4420-1254-0x0000000000000000-mapping.dmp
-
memory/4420-1737-0x0000000000000000-mapping.dmp
-
memory/4424-1422-0x0000000000000000-mapping.dmp
-
memory/4424-1135-0x0000000000000000-mapping.dmp
-
memory/4428-336-0x0000000000000000-mapping.dmp
-
memory/4436-1635-0x0000000000000000-mapping.dmp
-
memory/4444-1739-0x0000000000000000-mapping.dmp
-
memory/4444-1833-0x0000000000000000-mapping.dmp
-
memory/4448-1048-0x000000000041A1F8-mapping.dmp
-
memory/4448-569-0x0000000000000000-mapping.dmp
-
memory/4452-1692-0x0000000000000000-mapping.dmp
-
memory/4456-1484-0x0000000000000000-mapping.dmp
-
memory/4464-871-0x0000000000000000-mapping.dmp
-
memory/4464-1024-0x000000000041A1F8-mapping.dmp
-
memory/4468-1941-0x0000000000000000-mapping.dmp
-
memory/4468-1845-0x0000000000000000-mapping.dmp
-
memory/4472-1057-0x0000000000000000-mapping.dmp
-
memory/4476-1686-0x0000000000000000-mapping.dmp
-
memory/4476-337-0x0000000000000000-mapping.dmp
-
memory/4480-1247-0x0000000000000000-mapping.dmp
-
memory/4484-1074-0x0000000000000000-mapping.dmp
-
memory/4488-1068-0x0000000000000000-mapping.dmp
-
memory/4492-649-0x0000000000000000-mapping.dmp
-
memory/4500-855-0x0000000000000000-mapping.dmp
-
memory/4500-1573-0x0000000000000000-mapping.dmp
-
memory/4500-1392-0x0000000000000000-mapping.dmp
-
memory/4504-1553-0x000000000041A1F8-mapping.dmp
-
memory/4508-338-0x0000000000000000-mapping.dmp
-
memory/4508-1022-0x0000000000000000-mapping.dmp
-
memory/4520-953-0x000000000041A1F8-mapping.dmp
-
memory/4524-1890-0x0000000000000000-mapping.dmp
-
memory/4528-340-0x000000000041A1F8-mapping.dmp
-
memory/4528-1007-0x0000000000000000-mapping.dmp
-
memory/4528-1479-0x000000000041A1F8-mapping.dmp
-
memory/4532-1904-0x0000000000000000-mapping.dmp
-
memory/4544-827-0x000000000041A1F8-mapping.dmp
-
memory/4544-1885-0x0000000000000000-mapping.dmp
-
memory/4548-1045-0x0000000000000000-mapping.dmp
-
memory/4556-1669-0x0000000000000000-mapping.dmp
-
memory/4564-1859-0x0000000000000000-mapping.dmp
-
memory/4564-1723-0x0000000000000000-mapping.dmp
-
memory/4568-980-0x000000000041A1F8-mapping.dmp
-
memory/4572-723-0x0000000000000000-mapping.dmp
-
memory/4572-867-0x0000000000000000-mapping.dmp
-
memory/4572-1802-0x0000000000000000-mapping.dmp
-
memory/4576-1261-0x0000000000000000-mapping.dmp
-
memory/4576-811-0x0000000000000000-mapping.dmp
-
memory/4580-1853-0x0000000000000000-mapping.dmp
-
memory/4580-644-0x0000000000000000-mapping.dmp
-
memory/4584-1054-0x000000000041A1F8-mapping.dmp
-
memory/4588-1359-0x000000000041A1F8-mapping.dmp
-
memory/4592-1602-0x0000000000000000-mapping.dmp
-
memory/4596-488-0x000000000041A1F8-mapping.dmp
-
memory/4600-1417-0x0000000000000000-mapping.dmp
-
memory/4600-815-0x000000000041A1F8-mapping.dmp
-
memory/4604-665-0x0000000000000000-mapping.dmp
-
memory/4604-1685-0x0000000000000000-mapping.dmp
-
memory/4604-547-0x000000000041A1F8-mapping.dmp
-
memory/4616-1514-0x0000000000000000-mapping.dmp
-
memory/4616-1096-0x000000000041A1F8-mapping.dmp
-
memory/4632-342-0x0000000000000000-mapping.dmp
-
memory/4640-542-0x0000000000000000-mapping.dmp
-
memory/4644-1051-0x0000000000000000-mapping.dmp
-
memory/4648-1587-0x000000000041A1F8-mapping.dmp
-
memory/4652-1909-0x0000000000000000-mapping.dmp
-
memory/4652-343-0x0000000000000000-mapping.dmp
-
memory/4652-1451-0x0000000000000000-mapping.dmp
-
memory/4660-1673-0x0000000000000000-mapping.dmp
-
memory/4664-1689-0x000000000041A1F8-mapping.dmp
-
memory/4664-1905-0x0000000000000000-mapping.dmp
-
memory/4664-1500-0x000000000041A1F8-mapping.dmp
-
memory/4668-344-0x0000000000000000-mapping.dmp
-
memory/4668-1767-0x0000000000000000-mapping.dmp
-
memory/4672-574-0x0000000000000000-mapping.dmp
-
memory/4672-1232-0x000000000041A1F8-mapping.dmp
-
memory/4672-1497-0x0000000000000000-mapping.dmp
-
memory/4680-1857-0x000000000041A1F8-mapping.dmp
-
memory/4684-1944-0x000000000041A1F8-mapping.dmp
-
memory/4688-1675-0x0000000000000000-mapping.dmp
-
memory/4688-1028-0x0000000000000000-mapping.dmp
-
memory/4692-1861-0x0000000000000000-mapping.dmp
-
memory/4692-1464-0x0000000000000000-mapping.dmp
-
memory/4696-1792-0x0000000000000000-mapping.dmp
-
memory/4696-1040-0x000000000041A1F8-mapping.dmp
-
memory/4700-637-0x0000000000000000-mapping.dmp
-
memory/4700-1742-0x0000000000000000-mapping.dmp
-
memory/4700-1429-0x000000000041A1F8-mapping.dmp
-
memory/4704-1475-0x0000000000000000-mapping.dmp
-
memory/4704-1725-0x000000000041A1F8-mapping.dmp
-
memory/4712-1928-0x0000000000000000-mapping.dmp
-
memory/4716-1854-0x0000000000000000-mapping.dmp
-
memory/4720-643-0x0000000000000000-mapping.dmp
-
memory/4720-813-0x0000000000000000-mapping.dmp
-
memory/4720-345-0x0000000000000000-mapping.dmp
-
memory/4728-1529-0x0000000000000000-mapping.dmp
-
memory/4732-1087-0x0000000000000000-mapping.dmp
-
memory/4732-1701-0x000000000041A1F8-mapping.dmp
-
memory/4744-1919-0x000000000041A1F8-mapping.dmp
-
memory/4748-1693-0x0000000000000000-mapping.dmp
-
memory/4748-346-0x0000000000000000-mapping.dmp
-
memory/4752-1314-0x0000000000000000-mapping.dmp
-
memory/4752-1799-0x000000000041A1F8-mapping.dmp
-
memory/4756-1248-0x0000000000000000-mapping.dmp
-
memory/4760-1907-0x000000000041A1F8-mapping.dmp
-
memory/4764-1431-0x0000000000000000-mapping.dmp
-
memory/4772-1851-0x0000000000000000-mapping.dmp
-
memory/4772-496-0x0000000000000000-mapping.dmp
-
memory/4776-834-0x0000000000000000-mapping.dmp
-
memory/4776-1657-0x000000000041A1F8-mapping.dmp
-
memory/4780-633-0x000000000041A1F8-mapping.dmp
-
memory/4780-1026-0x0000000000000000-mapping.dmp
-
memory/4780-847-0x0000000000000000-mapping.dmp
-
memory/4784-810-0x0000000000000000-mapping.dmp
-
memory/4788-348-0x000000000041A1F8-mapping.dmp
-
memory/4788-1490-0x0000000000000000-mapping.dmp
-
memory/4792-486-0x0000000000000000-mapping.dmp
-
memory/4792-1353-0x0000000000000000-mapping.dmp
-
memory/4800-1831-0x000000000041A1F8-mapping.dmp
-
memory/4804-1770-0x0000000000000000-mapping.dmp
-
memory/4808-996-0x0000000000000000-mapping.dmp
-
memory/4812-1070-0x000000000041A1F8-mapping.dmp
-
memory/4812-1581-0x0000000000000000-mapping.dmp
-
memory/4816-1249-0x0000000000000000-mapping.dmp
-
memory/4820-627-0x0000000000000000-mapping.dmp
-
memory/4820-1717-0x0000000000000000-mapping.dmp
-
memory/4824-1075-0x0000000000000000-mapping.dmp
-
memory/4828-1152-0x000000000041A1F8-mapping.dmp
-
memory/4828-1259-0x0000000000000000-mapping.dmp
-
memory/4828-1765-0x0000000000000000-mapping.dmp
-
memory/4836-1663-0x0000000000000000-mapping.dmp
-
memory/4836-1012-0x0000000000000000-mapping.dmp
-
memory/4840-601-0x0000000000000000-mapping.dmp
-
memory/4840-350-0x0000000000000000-mapping.dmp
-
memory/4852-1462-0x0000000000000000-mapping.dmp
-
memory/4860-668-0x0000000000000000-mapping.dmp
-
memory/4864-1503-0x0000000000000000-mapping.dmp
-
memory/4864-1781-0x000000000041A1F8-mapping.dmp
-
memory/4864-1850-0x000000000041A1F8-mapping.dmp
-
memory/4868-1763-0x0000000000000000-mapping.dmp
-
memory/4872-1473-0x000000000041A1F8-mapping.dmp
-
memory/4876-1229-0x0000000000000000-mapping.dmp
-
memory/4876-851-0x000000000041A1F8-mapping.dmp
-
memory/4876-1815-0x0000000000000000-mapping.dmp
-
memory/4880-986-0x0000000000000000-mapping.dmp
-
memory/4884-906-0x0000000000000000-mapping.dmp
-
memory/4884-351-0x0000000000000000-mapping.dmp
-
memory/4888-1461-0x0000000000000000-mapping.dmp
-
memory/4892-1911-0x0000000000000000-mapping.dmp
-
memory/4896-1439-0x0000000000000000-mapping.dmp
-
memory/4900-1910-0x0000000000000000-mapping.dmp
-
memory/4908-1934-0x0000000000000000-mapping.dmp
-
memory/4908-1015-0x0000000000000000-mapping.dmp
-
memory/4908-1080-0x0000000000000000-mapping.dmp
-
memory/4912-352-0x0000000000000000-mapping.dmp
-
memory/4916-1141-0x0000000000000000-mapping.dmp
-
memory/4916-1279-0x0000000000000000-mapping.dmp
-
memory/4920-730-0x000000000041A1F8-mapping.dmp
-
memory/4924-893-0x0000000000000000-mapping.dmp
-
memory/4928-518-0x000000000041A1F8-mapping.dmp
-
memory/4928-913-0x000000000041A1F8-mapping.dmp
-
memory/4932-809-0x0000000000000000-mapping.dmp
-
memory/4932-1797-0x0000000000000000-mapping.dmp
-
memory/4936-859-0x0000000000000000-mapping.dmp
-
memory/4944-354-0x000000000041A1F8-mapping.dmp
-
memory/4944-625-0x0000000000000000-mapping.dmp
-
memory/4948-854-0x0000000000000000-mapping.dmp
-
memory/4956-1659-0x0000000000000000-mapping.dmp
-
memory/4956-485-0x0000000000000000-mapping.dmp
-
memory/4956-1088-0x0000000000000000-mapping.dmp
-
memory/4956-1930-0x000000000041A1F8-mapping.dmp
-
memory/4956-839-0x0000000000000000-mapping.dmp
-
memory/4960-1787-0x0000000000000000-mapping.dmp
-
memory/4964-1674-0x0000000000000000-mapping.dmp
-
memory/4968-1827-0x0000000000000000-mapping.dmp
-
memory/4968-1531-0x000000000041A1F8-mapping.dmp
-
memory/4980-1709-0x0000000000000000-mapping.dmp
-
memory/4996-1032-0x0000000000000000-mapping.dmp
-
memory/5000-1662-0x0000000000000000-mapping.dmp
-
memory/5000-1860-0x0000000000000000-mapping.dmp
-
memory/5008-356-0x0000000000000000-mapping.dmp
-
memory/5008-611-0x000000000041A1F8-mapping.dmp
-
memory/5008-685-0x0000000000000000-mapping.dmp
-
memory/5012-1076-0x0000000000000000-mapping.dmp
-
memory/5016-818-0x0000000000000000-mapping.dmp
-
memory/5016-1437-0x000000000041A1F8-mapping.dmp
-
memory/5024-1178-0x0000000000000000-mapping.dmp
-
memory/5024-799-0x000000000041A1F8-mapping.dmp
-
memory/5036-1471-0x0000000000000000-mapping.dmp
-
memory/5040-693-0x000000000041A1F8-mapping.dmp
-
memory/5040-1913-0x000000000041A1F8-mapping.dmp
-
memory/5044-671-0x000000000041A1F8-mapping.dmp
-
memory/5044-1931-0x0000000000000000-mapping.dmp
-
memory/5048-1496-0x0000000000000000-mapping.dmp
-
memory/5060-660-0x0000000000000000-mapping.dmp
-
memory/5060-1027-0x0000000000000000-mapping.dmp
-
memory/5060-1467-0x000000000041A1F8-mapping.dmp
-
memory/5068-947-0x0000000000000000-mapping.dmp
-
memory/5072-823-0x0000000000000000-mapping.dmp
-
memory/5072-675-0x0000000000000000-mapping.dmp
-
memory/5076-1756-0x000000000041A1F8-mapping.dmp
-
memory/5076-606-0x0000000000000000-mapping.dmp
-
memory/5076-1416-0x0000000000000000-mapping.dmp
-
memory/5076-1882-0x000000000041A1F8-mapping.dmp
-
memory/5080-1775-0x000000000041A1F8-mapping.dmp
-
memory/5080-1017-0x000000000041A1F8-mapping.dmp
-
memory/5084-364-0x0000000000000000-mapping.dmp
-
memory/5088-1628-0x000000000041A1F8-mapping.dmp
-
memory/5092-1073-0x0000000000000000-mapping.dmp
-
memory/5100-1884-0x0000000000000000-mapping.dmp
-
memory/5100-1030-0x000000000041A1F8-mapping.dmp
-
memory/5104-1779-0x0000000000000000-mapping.dmp
-
memory/5104-718-0x0000000000000000-mapping.dmp
-
memory/5104-1415-0x0000000000000000-mapping.dmp
-
memory/5108-1285-0x0000000000000000-mapping.dmp
-
memory/5108-1124-0x000000000041A1F8-mapping.dmp
-
memory/5108-1668-0x0000000000000000-mapping.dmp
-
memory/5112-1691-0x0000000000000000-mapping.dmp
-
memory/5116-1253-0x0000000000000000-mapping.dmp
-
memory/5116-683-0x000000000041A1F8-mapping.dmp