REN42159.jar

General
Target

REN42159.jar

Filesize

401KB

Completed

06-08-2020 07:55

Score
10 /10
MD5

dc91a54b2286a05af54711ba5139a897

SHA1

ef36e7172287d286e7465442209d23d0d14ebf2e

SHA256

ddc0264f82a81e5c3070a77887e7840f0fbde2949b742b74381fe8ec39daa9b8

Malware Config
Signatures 14

Filter: none

Defense Evasion
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • QarallaxRAT

    Description

    Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

  • Qarallax RAT support DLL

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x000300000001355b-7.datqarallax_dll
  • Sets file execution options in registry

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Loads dropped DLL
    java.exe

    Reported IOCs

    pidprocess
    1432java.exe
  • Adds Run key to start application
    java.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOncejava.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WKBnewJ = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\tHFwB\\YIYZS.class\""java.exe
    Key created\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Runjava.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\WKBnewJ = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\tHFwB\\YIYZS.class\""java.exe
  • Drops desktop.ini file(s)
    attrib.exeattrib.exejava.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\tHFwB\Desktop.iniattrib.exe
    File opened for modificationC:\Users\Admin\tHFwB\Desktop.iniattrib.exe
    File opened for modificationC:\Users\Admin\tHFwB\Desktop.inijava.exe
    File createdC:\Users\Admin\tHFwB\Desktop.inijava.exe
  • Drops file in System32 directory
    java.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\System32\FPFrDjava.exe
    File opened for modificationC:\Windows\System32\FPFrDjava.exe
  • Kills process with taskkill
    taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

    Tags

    Reported IOCs

    pidprocess
    2272taskkill.exe
    1564taskkill.exe
    2324taskkill.exe
    2988taskkill.exe
    2384taskkill.exe
    1336taskkill.exe
    1904taskkill.exe
    2592taskkill.exe
    2400taskkill.exe
    1924taskkill.exe
    1552taskkill.exe
    1596taskkill.exe
    2176taskkill.exe
    560taskkill.exe
    1704taskkill.exe
    1840taskkill.exe
    2400taskkill.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    1568powershell.exe
    1568powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    WMIC.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege1536WMIC.exe
    Token: SeSecurityPrivilege1536WMIC.exe
    Token: SeTakeOwnershipPrivilege1536WMIC.exe
    Token: SeLoadDriverPrivilege1536WMIC.exe
    Token: SeSystemProfilePrivilege1536WMIC.exe
    Token: SeSystemtimePrivilege1536WMIC.exe
    Token: SeProfSingleProcessPrivilege1536WMIC.exe
    Token: SeIncBasePriorityPrivilege1536WMIC.exe
    Token: SeCreatePagefilePrivilege1536WMIC.exe
    Token: SeBackupPrivilege1536WMIC.exe
    Token: SeRestorePrivilege1536WMIC.exe
    Token: SeShutdownPrivilege1536WMIC.exe
    Token: SeDebugPrivilege1536WMIC.exe
    Token: SeSystemEnvironmentPrivilege1536WMIC.exe
    Token: SeRemoteShutdownPrivilege1536WMIC.exe
    Token: SeUndockPrivilege1536WMIC.exe
    Token: SeManageVolumePrivilege1536WMIC.exe
    Token: 331536WMIC.exe
    Token: 341536WMIC.exe
    Token: 351536WMIC.exe
    Token: SeIncreaseQuotaPrivilege1536WMIC.exe
    Token: SeSecurityPrivilege1536WMIC.exe
    Token: SeTakeOwnershipPrivilege1536WMIC.exe
    Token: SeLoadDriverPrivilege1536WMIC.exe
    Token: SeSystemProfilePrivilege1536WMIC.exe
    Token: SeSystemtimePrivilege1536WMIC.exe
    Token: SeProfSingleProcessPrivilege1536WMIC.exe
    Token: SeIncBasePriorityPrivilege1536WMIC.exe
    Token: SeCreatePagefilePrivilege1536WMIC.exe
    Token: SeBackupPrivilege1536WMIC.exe
    Token: SeRestorePrivilege1536WMIC.exe
    Token: SeShutdownPrivilege1536WMIC.exe
    Token: SeDebugPrivilege1536WMIC.exe
    Token: SeSystemEnvironmentPrivilege1536WMIC.exe
    Token: SeRemoteShutdownPrivilege1536WMIC.exe
    Token: SeUndockPrivilege1536WMIC.exe
    Token: SeManageVolumePrivilege1536WMIC.exe
    Token: 331536WMIC.exe
    Token: 341536WMIC.exe
    Token: 351536WMIC.exe
    Token: SeIncreaseQuotaPrivilege1792WMIC.exe
    Token: SeSecurityPrivilege1792WMIC.exe
    Token: SeTakeOwnershipPrivilege1792WMIC.exe
    Token: SeLoadDriverPrivilege1792WMIC.exe
    Token: SeSystemProfilePrivilege1792WMIC.exe
    Token: SeSystemtimePrivilege1792WMIC.exe
    Token: SeProfSingleProcessPrivilege1792WMIC.exe
    Token: SeIncBasePriorityPrivilege1792WMIC.exe
    Token: SeCreatePagefilePrivilege1792WMIC.exe
    Token: SeBackupPrivilege1792WMIC.exe
    Token: SeRestorePrivilege1792WMIC.exe
    Token: SeShutdownPrivilege1792WMIC.exe
    Token: SeDebugPrivilege1792WMIC.exe
    Token: SeSystemEnvironmentPrivilege1792WMIC.exe
    Token: SeRemoteShutdownPrivilege1792WMIC.exe
    Token: SeUndockPrivilege1792WMIC.exe
    Token: SeManageVolumePrivilege1792WMIC.exe
    Token: 331792WMIC.exe
    Token: 341792WMIC.exe
    Token: 351792WMIC.exe
    Token: SeIncreaseQuotaPrivilege1792WMIC.exe
    Token: SeSecurityPrivilege1792WMIC.exe
    Token: SeTakeOwnershipPrivilege1792WMIC.exe
    Token: SeLoadDriverPrivilege1792WMIC.exe
  • Suspicious use of SetWindowsHookEx
    java.exe

    Reported IOCs

    pidprocess
    1432java.exe
  • Suspicious use of WriteProcessMemory
    java.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1432 wrote to memory of 10841432java.execmd.exe
    PID 1432 wrote to memory of 10841432java.execmd.exe
    PID 1432 wrote to memory of 10841432java.execmd.exe
    PID 1432 wrote to memory of 11121432java.execmd.exe
    PID 1432 wrote to memory of 11121432java.execmd.exe
    PID 1432 wrote to memory of 11121432java.execmd.exe
    PID 1112 wrote to memory of 15361112cmd.exeWMIC.exe
    PID 1112 wrote to memory of 15361112cmd.exeWMIC.exe
    PID 1112 wrote to memory of 15361112cmd.exeWMIC.exe
    PID 1432 wrote to memory of 12521432java.execmd.exe
    PID 1432 wrote to memory of 12521432java.execmd.exe
    PID 1432 wrote to memory of 12521432java.execmd.exe
    PID 1252 wrote to memory of 17921252cmd.exeWMIC.exe
    PID 1252 wrote to memory of 17921252cmd.exeWMIC.exe
    PID 1252 wrote to memory of 17921252cmd.exeWMIC.exe
    PID 1432 wrote to memory of 17761432java.exeattrib.exe
    PID 1432 wrote to memory of 17761432java.exeattrib.exe
    PID 1432 wrote to memory of 17761432java.exeattrib.exe
    PID 1432 wrote to memory of 5201432java.exeattrib.exe
    PID 1432 wrote to memory of 5201432java.exeattrib.exe
    PID 1432 wrote to memory of 5201432java.exeattrib.exe
    PID 1432 wrote to memory of 6281432java.exeattrib.exe
    PID 1432 wrote to memory of 6281432java.exeattrib.exe
    PID 1432 wrote to memory of 6281432java.exeattrib.exe
    PID 1432 wrote to memory of 9681432java.exeattrib.exe
    PID 1432 wrote to memory of 9681432java.exeattrib.exe
    PID 1432 wrote to memory of 9681432java.exeattrib.exe
    PID 1432 wrote to memory of 12441432java.exeattrib.exe
    PID 1432 wrote to memory of 12441432java.exeattrib.exe
    PID 1432 wrote to memory of 12441432java.exeattrib.exe
    PID 1432 wrote to memory of 7001432java.exeattrib.exe
    PID 1432 wrote to memory of 7001432java.exeattrib.exe
    PID 1432 wrote to memory of 7001432java.exeattrib.exe
    PID 1432 wrote to memory of 15241432java.exeattrib.exe
    PID 1432 wrote to memory of 15241432java.exeattrib.exe
    PID 1432 wrote to memory of 15241432java.exeattrib.exe
    PID 1432 wrote to memory of 13321432java.exeattrib.exe
    PID 1432 wrote to memory of 13321432java.exeattrib.exe
    PID 1432 wrote to memory of 13321432java.exeattrib.exe
    PID 1432 wrote to memory of 16841432java.execmd.exe
    PID 1432 wrote to memory of 16841432java.execmd.exe
    PID 1432 wrote to memory of 16841432java.execmd.exe
    PID 1432 wrote to memory of 15681432java.exepowershell.exe
    PID 1432 wrote to memory of 15681432java.exepowershell.exe
    PID 1432 wrote to memory of 15681432java.exepowershell.exe
    PID 1432 wrote to memory of 19441432java.exereg.exe
    PID 1432 wrote to memory of 19441432java.exereg.exe
    PID 1432 wrote to memory of 19441432java.exereg.exe
    PID 1432 wrote to memory of 19241432java.exetaskkill.exe
    PID 1432 wrote to memory of 19241432java.exetaskkill.exe
    PID 1432 wrote to memory of 19241432java.exetaskkill.exe
    PID 1432 wrote to memory of 19521432java.exereg.exe
    PID 1432 wrote to memory of 19521432java.exereg.exe
    PID 1432 wrote to memory of 19521432java.exereg.exe
    PID 1684 wrote to memory of 20041684cmd.exereg.exe
    PID 1684 wrote to memory of 20041684cmd.exereg.exe
    PID 1684 wrote to memory of 20041684cmd.exereg.exe
    PID 1432 wrote to memory of 19841432java.exereg.exe
    PID 1432 wrote to memory of 19841432java.exereg.exe
    PID 1432 wrote to memory of 19841432java.exereg.exe
    PID 1432 wrote to memory of 19681432java.exereg.exe
    PID 1432 wrote to memory of 19681432java.exereg.exe
    PID 1432 wrote to memory of 19681432java.exereg.exe
    PID 1432 wrote to memory of 20241432java.exereg.exe
  • Views/modifies file attributes
    attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    628attrib.exe
    968attrib.exe
    1244attrib.exe
    700attrib.exe
    1524attrib.exe
    1332attrib.exe
    1776attrib.exe
    520attrib.exe
Processes 260
  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\REN42159.jar
    Loads dropped DLL
    Adds Run key to start application
    Drops desktop.ini file(s)
    Drops file in System32 directory
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1084
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        Suspicious use of AdjustPrivilegeToken
        PID:1536
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
        Suspicious use of AdjustPrivilegeToken
        PID:1792
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\Oracle
      Views/modifies file attributes
      PID:1776
    • C:\Windows\system32\attrib.exe
      attrib +h +r +s C:\Users\Admin\.ntusernt.ini
      Views/modifies file attributes
      PID:520
    • C:\Windows\system32\attrib.exe
      attrib -s -r C:\Users\Admin\tHFwB\Desktop.ini
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:628
    • C:\Windows\system32\attrib.exe
      attrib +s +r C:\Users\Admin\tHFwB\Desktop.ini
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:968
    • C:\Windows\system32\attrib.exe
      attrib -s -r C:\Users\Admin\tHFwB
      Views/modifies file attributes
      PID:1244
    • C:\Windows\system32\attrib.exe
      attrib +s +r C:\Users\Admin\tHFwB
      Views/modifies file attributes
      PID:700
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\tHFwB
      Views/modifies file attributes
      PID:1524
    • C:\Windows\system32\attrib.exe
      attrib +h +s +r C:\Users\Admin\tHFwB\YIYZS.class
      Views/modifies file attributes
      PID:1332
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\system32\reg.exe
        reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
        PID:2004
      • C:\Windows\system32\reg.exe
        reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
        PID:1532
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\tHFwB','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\tHFwB\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
      Suspicious behavior: EnumeratesProcesses
      PID:1568
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1944
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f
      PID:1952
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
      Kills process with taskkill
      PID:1924
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f
      PID:1984
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1968
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f
      PID:2024
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1296
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f
      PID:848
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
      PID:1032
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1464
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
      PID:1804
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1792
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      PID:1064
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1416
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1656
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
        PID:1704
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
        PID:1960
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      PID:1904
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1972
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      PID:1292
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
      Kills process with taskkill
      PID:1552
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      PID:1132
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1808
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1236
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1116
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1636
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1076
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1528
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1124
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:652
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1988
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1820
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
      Kills process with taskkill
      PID:1336
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1696
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
        PID:328
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
        PID:428
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
      Kills process with taskkill
      PID:1904
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1640
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
        PID:1960
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
        PID:1636
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
      Kills process with taskkill
      PID:1704
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1520
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
        PID:1108
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
        PID:1076
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1032
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
        PID:560
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
        PID:1768
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1500
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
        PID:1292
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
        PID:1572
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1400
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
        PID:1108
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
        PID:328
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
      Kills process with taskkill
      PID:1840
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1820
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
        PID:328
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
        PID:2056
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2080
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
        PID:2112
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
        PID:2144
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2160
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
        PID:2176
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
        PID:2188
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2200
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
        PID:2216
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
        PID:2236
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2248
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
        PID:2260
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
        PID:2284
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
      Kills process with taskkill
      PID:2272
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2308
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
        PID:2320
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
        PID:2340
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2356
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
        PID:2380
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
        PID:2392
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2404
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
        PID:2416
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
        PID:2432
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2444
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:64
        PID:2456
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:32
        PID:2484
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2500
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
        PID:2512
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
        PID:2528
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2540
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
        PID:2552
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
        PID:2580
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
      Kills process with taskkill
      PID:2592
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2608
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
        PID:2644
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
        PID:2668
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2684
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:64
        PID:2712
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:32
        PID:2724
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2744
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
        PID:2756
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
        PID:2768
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2780
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
        PID:2796
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
        PID:2808
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2820
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:64
        PID:2832
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:32
        PID:2844
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2856
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
        PID:2868
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
        PID:2880
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2892
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
        PID:2904
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
        PID:2916
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2928
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
        PID:2940
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
        PID:2952
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2964
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:64
        PID:2976
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:32
        PID:3000
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
      Kills process with taskkill
      PID:2988
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:3028
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:64
        PID:3052
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:32
        PID:2052
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2064
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:64
        PID:2088
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:32
        PID:860
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:820
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:64
        PID:1648
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:32
        PID:2156
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1764
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:64
        PID:1836
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:32
        PID:1900
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2144
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:64
        PID:1964
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:32
        PID:1848
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1908
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:64
        PID:2180
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:32
        PID:2196
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2188
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:64
        PID:1792
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:32
        PID:608
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1772
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:64
        PID:1844
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:32
        PID:1860
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1840
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:64
        PID:2220
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:32
        PID:1604
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:64
        PID:1704
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:32
        PID:2216
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2244
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:64
        PID:2268
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:32
        PID:2300
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2288
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:64
        PID:2316
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:32
        PID:2348
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2340
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:64
        PID:2384
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:32
        PID:2332
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
      Kills process with taskkill
      PID:2400
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2368
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:64
        PID:2416
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:32
        PID:2464
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2476
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:64
        PID:2456
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:32
        PID:2496
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2524
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:64
        PID:2512
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:32
        PID:2548
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2564
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:64
        PID:2576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:32
        PID:1796
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2584
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:64
        PID:2624
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:32
        PID:2636
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2652
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:64
        PID:2648
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:32
        PID:2672
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2708
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:64
        PID:2704
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:32
        PID:2664
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2680
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
        PID:2592
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
        PID:2724
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2752
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
        PID:2776
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
        PID:2768
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1096
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
        PID:1252
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
        PID:700
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:628
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:64
        PID:1080
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:32
        PID:2748
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2500
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
        PID:2688
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
        PID:2308
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2204
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:64
        PID:2540
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:32
        PID:2448
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1400
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
        PID:652
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
        PID:2248
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
      Kills process with taskkill
      PID:1596
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:392
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
        PID:1120
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
        PID:2160
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1048
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
        PID:1088
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
        PID:2788
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2816
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
        PID:2808
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
        PID:2836
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2848
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
        PID:2876
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
        PID:2868
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2900
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
        PID:2924
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
        PID:2916
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2944
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
        PID:2956
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
        PID:2984
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:3016
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:64
        PID:3004
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:32
        PID:3060
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2060
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:64
        PID:3024
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:32
        PID:2992
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:3012
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:64
        PID:2052
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:32
        PID:2136
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2116
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
        PID:1336
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
        PID:1648
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1940
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
        PID:2148
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
        PID:1900
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:2172
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
        PID:268
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
        PID:2184
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
      Kills process with taskkill
      PID:2176
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
      Kills process with taskkill
      PID:560
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
      Kills process with taskkill
      PID:1564
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
      Kills process with taskkill
      PID:2324
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
      Kills process with taskkill
      PID:2384
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
      Kills process with taskkill
      PID:2400
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\.ntusernt.ini

                      • C:\Users\Admin\tHFwB\Desktop.ini

                      • C:\Users\Admin\tHFwB\YIYZS.class

                      • \Users\Admin\AppData\Local\Temp\bvJEkVYwQT662210377463324171.xml

                      • memory/268-278-0x0000000000000000-mapping.dmp

                      • memory/328-61-0x0000000000000000-mapping.dmp

                      • memory/328-80-0x0000000000000000-mapping.dmp

                      • memory/328-82-0x0000000000000000-mapping.dmp

                      • memory/392-244-0x0000000000000000-mapping.dmp

                      • memory/428-62-0x0000000000000000-mapping.dmp

                      • memory/520-8-0x0000000000000000-mapping.dmp

                      • memory/560-72-0x0000000000000000-mapping.dmp

                      • memory/560-281-0x0000000000000000-mapping.dmp

                      • memory/608-181-0x0000000000000000-mapping.dmp

                      • memory/628-10-0x0000000000000000-mapping.dmp

                      • memory/628-231-0x0000000000000000-mapping.dmp

                      • memory/652-52-0x0000000000000000-mapping.dmp

                      • memory/652-241-0x0000000000000000-mapping.dmp

                      • memory/700-14-0x0000000000000000-mapping.dmp

                      • memory/700-230-0x0000000000000000-mapping.dmp

                      • memory/820-167-0x0000000000000000-mapping.dmp

                      • memory/848-28-0x0000000000000000-mapping.dmp

                      • memory/860-166-0x0000000000000000-mapping.dmp

                      • memory/968-11-0x0000000000000000-mapping.dmp

                      • memory/1032-71-0x0000000000000000-mapping.dmp

                      • memory/1032-29-0x0000000000000000-mapping.dmp

                      • memory/1048-247-0x0000000000000000-mapping.dmp

                      • memory/1064-34-0x0000000000000000-mapping.dmp

                      • memory/1076-70-0x0000000000000000-mapping.dmp

                      • memory/1076-49-0x0000000000000000-mapping.dmp

                      • memory/1080-232-0x0000000000000000-mapping.dmp

                      • memory/1084-1-0x0000000000000000-mapping.dmp

                      • memory/1088-248-0x0000000000000000-mapping.dmp

                      • memory/1096-228-0x0000000000000000-mapping.dmp

                      • memory/1108-78-0x0000000000000000-mapping.dmp

                      • memory/1108-69-0x0000000000000000-mapping.dmp

                      • memory/1112-2-0x0000000000000000-mapping.dmp

                      • memory/1116-46-0x0000000000000000-mapping.dmp

                      • memory/1120-245-0x0000000000000000-mapping.dmp

                      • memory/1124-51-0x0000000000000000-mapping.dmp

                      • memory/1132-42-0x0000000000000000-mapping.dmp

                      • memory/1236-45-0x0000000000000000-mapping.dmp

                      • memory/1244-13-0x0000000000000000-mapping.dmp

                      • memory/1252-229-0x0000000000000000-mapping.dmp

                      • memory/1252-4-0x0000000000000000-mapping.dmp

                      • memory/1292-39-0x0000000000000000-mapping.dmp

                      • memory/1292-75-0x0000000000000000-mapping.dmp

                      • memory/1296-27-0x0000000000000000-mapping.dmp

                      • memory/1332-16-0x0000000000000000-mapping.dmp

                      • memory/1336-272-0x0000000000000000-mapping.dmp

                      • memory/1336-55-0x0000000000000000-mapping.dmp

                      • memory/1400-77-0x0000000000000000-mapping.dmp

                      • memory/1400-240-0x0000000000000000-mapping.dmp

                      • memory/1416-35-0x0000000000000000-mapping.dmp

                      • memory/1464-30-0x0000000000000000-mapping.dmp

                      • memory/1500-74-0x0000000000000000-mapping.dmp

                      • memory/1520-68-0x0000000000000000-mapping.dmp

                      • memory/1524-15-0x0000000000000000-mapping.dmp

                      • memory/1528-50-0x0000000000000000-mapping.dmp

                      • memory/1532-31-0x0000000000000000-mapping.dmp

                      • memory/1536-3-0x0000000000000000-mapping.dmp

                      • memory/1552-40-0x0000000000000000-mapping.dmp

                      • memory/1564-282-0x0000000000000000-mapping.dmp

                      • memory/1568-19-0x0000000000000000-mapping.dmp

                      • memory/1568-60-0x00000000025E0000-0x00000000025E1000-memory.dmp

                      • memory/1568-135-0x0000000002780000-0x0000000002781000-memory.dmp

                      • memory/1568-67-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

                      • memory/1568-112-0x0000000002890000-0x0000000002891000-memory.dmp

                      • memory/1568-57-0x000000001AC20000-0x000000001AC21000-memory.dmp

                      • memory/1568-56-0x0000000002380000-0x0000000002381000-memory.dmp

                      • memory/1568-138-0x0000000002790000-0x0000000002791000-memory.dmp

                      • memory/1568-44-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp

                      • memory/1568-108-0x0000000002750000-0x0000000002751000-memory.dmp

                      • memory/1572-76-0x0000000000000000-mapping.dmp

                      • memory/1596-243-0x0000000000000000-mapping.dmp

                      • memory/1604-187-0x0000000000000000-mapping.dmp

                      • memory/1636-66-0x0000000000000000-mapping.dmp

                      • memory/1636-47-0x0000000000000000-mapping.dmp

                      • memory/1640-63-0x0000000000000000-mapping.dmp

                      • memory/1648-273-0x0000000000000000-mapping.dmp

                      • memory/1648-168-0x0000000000000000-mapping.dmp

                      • memory/1656-36-0x0000000000000000-mapping.dmp

                      • memory/1684-18-0x0000000000000000-mapping.dmp

                      • memory/1696-58-0x0000000000000000-mapping.dmp

                      • memory/1704-41-0x0000000000000000-mapping.dmp

                      • memory/1704-189-0x0000000000000000-mapping.dmp

                      • memory/1704-64-0x0000000000000000-mapping.dmp

                      • memory/1764-170-0x0000000000000000-mapping.dmp

                      • memory/1768-73-0x0000000000000000-mapping.dmp

                      • memory/1772-182-0x0000000000000000-mapping.dmp

                      • memory/1776-6-0x0000000000000000-mapping.dmp

                      • memory/1792-33-0x0000000000000000-mapping.dmp

                      • memory/1792-180-0x0000000000000000-mapping.dmp

                      • memory/1792-5-0x0000000000000000-mapping.dmp

                      • memory/1796-212-0x0000000000000000-mapping.dmp

                      • memory/1804-32-0x0000000000000000-mapping.dmp

                      • memory/1808-43-0x0000000000000000-mapping.dmp

                      • memory/1820-81-0x0000000000000000-mapping.dmp

                      • memory/1820-54-0x0000000000000000-mapping.dmp

                      • memory/1836-171-0x0000000000000000-mapping.dmp

                      • memory/1840-185-0x0000000000000000-mapping.dmp

                      • memory/1840-79-0x0000000000000000-mapping.dmp

                      • memory/1844-183-0x0000000000000000-mapping.dmp

                      • memory/1848-175-0x0000000000000000-mapping.dmp

                      • memory/1860-184-0x0000000000000000-mapping.dmp

                      • memory/1900-276-0x0000000000000000-mapping.dmp

                      • memory/1900-172-0x0000000000000000-mapping.dmp

                      • memory/1904-59-0x0000000000000000-mapping.dmp

                      • memory/1904-37-0x0000000000000000-mapping.dmp

                      • memory/1908-176-0x0000000000000000-mapping.dmp

                      • memory/1924-21-0x0000000000000000-mapping.dmp

                      • memory/1940-274-0x0000000000000000-mapping.dmp

                      • memory/1944-20-0x0000000000000000-mapping.dmp

                      • memory/1952-22-0x0000000000000000-mapping.dmp

                      • memory/1960-48-0x0000000000000000-mapping.dmp

                      • memory/1960-65-0x0000000000000000-mapping.dmp

                      • memory/1964-174-0x0000000000000000-mapping.dmp

                      • memory/1968-25-0x0000000000000000-mapping.dmp

                      • memory/1972-38-0x0000000000000000-mapping.dmp

                      • memory/1984-24-0x0000000000000000-mapping.dmp

                      • memory/1988-188-0x0000000000000000-mapping.dmp

                      • memory/1988-53-0x0000000000000000-mapping.dmp

                      • memory/2004-23-0x0000000000000000-mapping.dmp

                      • memory/2024-26-0x0000000000000000-mapping.dmp

                      • memory/2052-163-0x0000000000000000-mapping.dmp

                      • memory/2052-269-0x0000000000000000-mapping.dmp

                      • memory/2056-83-0x0000000000000000-mapping.dmp

                      • memory/2060-265-0x0000000000000000-mapping.dmp

                      • memory/2064-164-0x0000000000000000-mapping.dmp

                      • memory/2080-84-0x0000000000000000-mapping.dmp

                      • memory/2088-165-0x0000000000000000-mapping.dmp

                      • memory/2112-85-0x0000000000000000-mapping.dmp

                      • memory/2116-271-0x0000000000000000-mapping.dmp

                      • memory/2136-270-0x0000000000000000-mapping.dmp

                      • memory/2144-86-0x0000000000000000-mapping.dmp

                      • memory/2144-173-0x0000000000000000-mapping.dmp

                      • memory/2148-275-0x0000000000000000-mapping.dmp

                      • memory/2156-169-0x0000000000000000-mapping.dmp

                      • memory/2160-246-0x0000000000000000-mapping.dmp

                      • memory/2160-87-0x0000000000000000-mapping.dmp

                      • memory/2172-277-0x0000000000000000-mapping.dmp

                      • memory/2176-88-0x0000000000000000-mapping.dmp

                      • memory/2176-280-0x0000000000000000-mapping.dmp

                      • memory/2180-177-0x0000000000000000-mapping.dmp

                      • memory/2184-279-0x0000000000000000-mapping.dmp

                      • memory/2188-89-0x0000000000000000-mapping.dmp

                      • memory/2188-179-0x0000000000000000-mapping.dmp

                      • memory/2196-178-0x0000000000000000-mapping.dmp

                      • memory/2200-90-0x0000000000000000-mapping.dmp

                      • memory/2204-237-0x0000000000000000-mapping.dmp

                      • memory/2216-91-0x0000000000000000-mapping.dmp

                      • memory/2216-190-0x0000000000000000-mapping.dmp

                      • memory/2220-186-0x0000000000000000-mapping.dmp

                      • memory/2236-92-0x0000000000000000-mapping.dmp

                      • memory/2244-191-0x0000000000000000-mapping.dmp

                      • memory/2248-93-0x0000000000000000-mapping.dmp

                      • memory/2248-242-0x0000000000000000-mapping.dmp

                      • memory/2260-94-0x0000000000000000-mapping.dmp

                      • memory/2268-192-0x0000000000000000-mapping.dmp

                      • memory/2272-95-0x0000000000000000-mapping.dmp

                      • memory/2284-96-0x0000000000000000-mapping.dmp

                      • memory/2288-194-0x0000000000000000-mapping.dmp

                      • memory/2300-193-0x0000000000000000-mapping.dmp

                      • memory/2308-97-0x0000000000000000-mapping.dmp

                      • memory/2308-236-0x0000000000000000-mapping.dmp

                      • memory/2316-195-0x0000000000000000-mapping.dmp

                      • memory/2320-98-0x0000000000000000-mapping.dmp

                      • memory/2324-283-0x0000000000000000-mapping.dmp

                      • memory/2332-200-0x0000000000000000-mapping.dmp

                      • memory/2340-197-0x0000000000000000-mapping.dmp

                      • memory/2340-99-0x0000000000000000-mapping.dmp

                      • memory/2348-196-0x0000000000000000-mapping.dmp

                      • memory/2356-100-0x0000000000000000-mapping.dmp

                      • memory/2368-201-0x0000000000000000-mapping.dmp

                      • memory/2380-101-0x0000000000000000-mapping.dmp

                      • memory/2384-198-0x0000000000000000-mapping.dmp

                      • memory/2384-284-0x0000000000000000-mapping.dmp

                      • memory/2392-102-0x0000000000000000-mapping.dmp

                      • memory/2400-199-0x0000000000000000-mapping.dmp

                      • memory/2400-285-0x0000000000000000-mapping.dmp

                      • memory/2404-103-0x0000000000000000-mapping.dmp

                      • memory/2416-104-0x0000000000000000-mapping.dmp

                      • memory/2416-202-0x0000000000000000-mapping.dmp

                      • memory/2432-105-0x0000000000000000-mapping.dmp

                      • memory/2444-106-0x0000000000000000-mapping.dmp

                      • memory/2448-239-0x0000000000000000-mapping.dmp

                      • memory/2456-107-0x0000000000000000-mapping.dmp

                      • memory/2456-205-0x0000000000000000-mapping.dmp

                      • memory/2464-203-0x0000000000000000-mapping.dmp

                      • memory/2476-204-0x0000000000000000-mapping.dmp

                      • memory/2484-111-0x0000000000000000-mapping.dmp

                      • memory/2496-206-0x0000000000000000-mapping.dmp

                      • memory/2500-113-0x0000000000000000-mapping.dmp

                      • memory/2500-234-0x0000000000000000-mapping.dmp

                      • memory/2512-115-0x0000000000000000-mapping.dmp

                      • memory/2512-208-0x0000000000000000-mapping.dmp

                      • memory/2524-207-0x0000000000000000-mapping.dmp

                      • memory/2528-116-0x0000000000000000-mapping.dmp

                      • memory/2540-238-0x0000000000000000-mapping.dmp

                      • memory/2540-117-0x0000000000000000-mapping.dmp

                      • memory/2548-209-0x0000000000000000-mapping.dmp

                      • memory/2552-118-0x0000000000000000-mapping.dmp

                      • memory/2564-210-0x0000000000000000-mapping.dmp

                      • memory/2576-211-0x0000000000000000-mapping.dmp

                      • memory/2580-123-0x0000000000000000-mapping.dmp

                      • memory/2584-213-0x0000000000000000-mapping.dmp

                      • memory/2592-124-0x0000000000000000-mapping.dmp

                      • memory/2592-223-0x0000000000000000-mapping.dmp

                      • memory/2608-126-0x0000000000000000-mapping.dmp

                      • memory/2624-214-0x0000000000000000-mapping.dmp

                      • memory/2636-215-0x0000000000000000-mapping.dmp

                      • memory/2644-130-0x0000000000000000-mapping.dmp

                      • memory/2648-217-0x0000000000000000-mapping.dmp

                      • memory/2652-216-0x0000000000000000-mapping.dmp

                      • memory/2664-221-0x0000000000000000-mapping.dmp

                      • memory/2668-133-0x0000000000000000-mapping.dmp

                      • memory/2672-218-0x0000000000000000-mapping.dmp

                      • memory/2680-222-0x0000000000000000-mapping.dmp

                      • memory/2684-134-0x0000000000000000-mapping.dmp

                      • memory/2688-235-0x0000000000000000-mapping.dmp

                      • memory/2704-220-0x0000000000000000-mapping.dmp

                      • memory/2708-219-0x0000000000000000-mapping.dmp

                      • memory/2712-136-0x0000000000000000-mapping.dmp

                      • memory/2724-137-0x0000000000000000-mapping.dmp

                      • memory/2724-224-0x0000000000000000-mapping.dmp

                      • memory/2744-139-0x0000000000000000-mapping.dmp

                      • memory/2748-233-0x0000000000000000-mapping.dmp

                      • memory/2752-225-0x0000000000000000-mapping.dmp

                      • memory/2756-140-0x0000000000000000-mapping.dmp

                      • memory/2768-141-0x0000000000000000-mapping.dmp

                      • memory/2768-227-0x0000000000000000-mapping.dmp

                      • memory/2776-226-0x0000000000000000-mapping.dmp

                      • memory/2780-142-0x0000000000000000-mapping.dmp

                      • memory/2788-249-0x0000000000000000-mapping.dmp

                      • memory/2796-143-0x0000000000000000-mapping.dmp

                      • memory/2808-144-0x0000000000000000-mapping.dmp

                      • memory/2808-251-0x0000000000000000-mapping.dmp

                      • memory/2816-250-0x0000000000000000-mapping.dmp

                      • memory/2820-145-0x0000000000000000-mapping.dmp

                      • memory/2832-146-0x0000000000000000-mapping.dmp

                      • memory/2836-252-0x0000000000000000-mapping.dmp

                      • memory/2844-147-0x0000000000000000-mapping.dmp

                      • memory/2848-253-0x0000000000000000-mapping.dmp

                      • memory/2856-148-0x0000000000000000-mapping.dmp

                      • memory/2868-149-0x0000000000000000-mapping.dmp

                      • memory/2868-255-0x0000000000000000-mapping.dmp

                      • memory/2876-254-0x0000000000000000-mapping.dmp

                      • memory/2880-150-0x0000000000000000-mapping.dmp

                      • memory/2892-151-0x0000000000000000-mapping.dmp

                      • memory/2900-256-0x0000000000000000-mapping.dmp

                      • memory/2904-152-0x0000000000000000-mapping.dmp

                      • memory/2916-258-0x0000000000000000-mapping.dmp

                      • memory/2916-153-0x0000000000000000-mapping.dmp

                      • memory/2924-257-0x0000000000000000-mapping.dmp

                      • memory/2928-154-0x0000000000000000-mapping.dmp

                      • memory/2940-155-0x0000000000000000-mapping.dmp

                      • memory/2944-259-0x0000000000000000-mapping.dmp

                      • memory/2952-156-0x0000000000000000-mapping.dmp

                      • memory/2956-260-0x0000000000000000-mapping.dmp

                      • memory/2964-157-0x0000000000000000-mapping.dmp

                      • memory/2976-158-0x0000000000000000-mapping.dmp

                      • memory/2984-261-0x0000000000000000-mapping.dmp

                      • memory/2988-159-0x0000000000000000-mapping.dmp

                      • memory/2992-267-0x0000000000000000-mapping.dmp

                      • memory/3000-160-0x0000000000000000-mapping.dmp

                      • memory/3004-263-0x0000000000000000-mapping.dmp

                      • memory/3012-268-0x0000000000000000-mapping.dmp

                      • memory/3016-262-0x0000000000000000-mapping.dmp

                      • memory/3024-266-0x0000000000000000-mapping.dmp

                      • memory/3028-161-0x0000000000000000-mapping.dmp

                      • memory/3052-162-0x0000000000000000-mapping.dmp

                      • memory/3060-264-0x0000000000000000-mapping.dmp