Analysis

  • max time kernel
    127s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    08-07-2020 05:20

General

  • Target

    c1c758539076d2ab8613711aca0af67e.jar

  • Size

    407KB

  • MD5

    c1c758539076d2ab8613711aca0af67e

  • SHA1

    5a6431b64e7273205c559f1061ef68710154a261

  • SHA256

    9f63d276056896914080bacd283c2c0cc4bf2122ae7513bced4f138ca53e8fc2

  • SHA512

    e6153e03674da40012d39274c2402677d6a2ccc5f48ee92cc2ccde68198afed387ad72a052752b6d9219ff301e8e223906d51b82855aa393fbdad1af6f34fc9f

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 320 IoCs
  • Suspicious use of AdjustPrivilegeToken 86 IoCs
  • Loads dropped DLL 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks for installed software on the system 1 TTPs 38 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Views/modifies file attributes 1 TTPs 8 IoCs
  • Adds Run entry to start application 2 TTPs 4 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\c1c758539076d2ab8613711aca0af67e.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Adds Run entry to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    PID:3020
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
        PID:3708
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:856
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:380
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1164
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h C:\Users\Admin\Oracle
        2⤵
        • Views/modifies file attributes
        PID:1428
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h +r +s C:\Users\Admin\.ntusernt.ini
        2⤵
        • Views/modifies file attributes
        PID:1660
      • C:\Windows\SYSTEM32\attrib.exe
        attrib -s -r C:\Users\Admin\WSDUo\Desktop.ini
        2⤵
        • Views/modifies file attributes
        • Drops desktop.ini file(s)
        PID:2004
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +r C:\Users\Admin\WSDUo\Desktop.ini
        2⤵
        • Views/modifies file attributes
        • Drops desktop.ini file(s)
        PID:2060
      • C:\Windows\SYSTEM32\attrib.exe
        attrib -s -r C:\Users\Admin\WSDUo
        2⤵
        • Views/modifies file attributes
        PID:2076
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +s +r C:\Users\Admin\WSDUo
        2⤵
        • Views/modifies file attributes
        PID:2136
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h C:\Users\Admin\WSDUo
        2⤵
        • Views/modifies file attributes
        PID:2624
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +h +s +r C:\Users\Admin\WSDUo\rfIqA.class
        2⤵
        • Views/modifies file attributes
        PID:2184
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\system32\reg.exe
          reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:64
          3⤵
          • Checks for installed software on the system
          PID:3496
        • C:\Windows\system32\reg.exe
          reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:32
          3⤵
          • Checks for installed software on the system
          PID:1756
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
        2⤵
        • Sets file execution options in registry
        PID:3640
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F
        2⤵
        • Kills process with taskkill
        PID:748
      • C:\Windows\System32\reg.exe
        "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
        2⤵
          PID:2776
        • C:\Windows\System32\reg.exe
          "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SEE_MASK_NOZONECHECKS" /t REG_SZ /d "1" /f
          2⤵
            PID:3568
          • C:\Windows\System32\reg.exe
            "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:64
            2⤵
            • Sets file execution options in registry
            PID:3452
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Windows\system32\reg.exe
              reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:64
              3⤵
              • Checks for installed software on the system
              PID:2132
            • C:\Windows\system32\reg.exe
              reg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:32
              3⤵
              • Checks for installed software on the system
              PID:2008
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2448
            • C:\Windows\system32\reg.exe
              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:64
              3⤵
              • Checks for installed software on the system
              PID:2108
            • C:\Windows\system32\reg.exe
              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:32
              3⤵
              • Checks for installed software on the system
              PID:2180
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\system32\reg.exe
              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:64
              3⤵
              • Checks for installed software on the system
              PID:1828
            • C:\Windows\system32\reg.exe
              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:32
              3⤵
                PID:2124
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2840
              • C:\Windows\system32\reg.exe
                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:64
                3⤵
                  PID:3592
                • C:\Windows\system32\reg.exe
                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:32
                  3⤵
                    PID:3348
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe
                  2⤵
                    PID:472
                    • C:\Windows\system32\reg.exe
                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:64
                      3⤵
                        PID:3640
                      • C:\Windows\system32\reg.exe
                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:32
                        3⤵
                          PID:996
                      • C:\Windows\System32\taskkill.exe
                        "C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F
                        2⤵
                        • Kills process with taskkill
                        PID:1620
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe
                        2⤵
                          PID:1368
                          • C:\Windows\system32\reg.exe
                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:64
                            3⤵
                              PID:1748
                            • C:\Windows\system32\reg.exe
                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:32
                              3⤵
                                PID:2176
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd.exe
                              2⤵
                                PID:2700
                                • C:\Windows\system32\reg.exe
                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:64
                                  3⤵
                                    PID:1556
                                  • C:\Windows\system32\reg.exe
                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:32
                                    3⤵
                                      PID:748
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    cmd.exe
                                    2⤵
                                      PID:3936
                                      • C:\Windows\system32\reg.exe
                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:64
                                        3⤵
                                          PID:2180
                                        • C:\Windows\system32\reg.exe
                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:32
                                          3⤵
                                            PID:2708
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          cmd.exe
                                          2⤵
                                            PID:1828
                                            • C:\Windows\system32\reg.exe
                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:64
                                              3⤵
                                                PID:1168
                                              • C:\Windows\system32\reg.exe
                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:32
                                                3⤵
                                                  PID:792
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                cmd.exe
                                                2⤵
                                                  PID:3996
                                                  • C:\Windows\system32\reg.exe
                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:64
                                                    3⤵
                                                      PID:3976
                                                    • C:\Windows\system32\reg.exe
                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:32
                                                      3⤵
                                                        PID:64
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      cmd.exe
                                                      2⤵
                                                        PID:2132
                                                        • C:\Windows\system32\reg.exe
                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:64
                                                          3⤵
                                                            PID:2148
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:32
                                                            3⤵
                                                              PID:492
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            cmd.exe
                                                            2⤵
                                                              PID:2484
                                                              • C:\Windows\system32\reg.exe
                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:64
                                                                3⤵
                                                                  PID:3848
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:32
                                                                  3⤵
                                                                    PID:1716
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe
                                                                  2⤵
                                                                    PID:2708
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:64
                                                                      3⤵
                                                                        PID:1192
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:32
                                                                        3⤵
                                                                          PID:1316
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd.exe
                                                                        2⤵
                                                                          PID:2452
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:64
                                                                            3⤵
                                                                            • Checks for installed software on the system
                                                                            PID:1400
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:32
                                                                            3⤵
                                                                              PID:2148
                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                            cmd.exe
                                                                            2⤵
                                                                              PID:752
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:64
                                                                                3⤵
                                                                                • Checks for installed software on the system
                                                                                PID:3388
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:32
                                                                                3⤵
                                                                                  PID:3348
                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                cmd.exe
                                                                                2⤵
                                                                                  PID:1192
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:64
                                                                                    3⤵
                                                                                      PID:3496
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:32
                                                                                      3⤵
                                                                                        PID:1604
                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                      cmd.exe
                                                                                      2⤵
                                                                                        PID:2516
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:64
                                                                                          3⤵
                                                                                          • Checks for installed software on the system
                                                                                          PID:1584
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:32
                                                                                          3⤵
                                                                                            PID:492
                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                          cmd.exe
                                                                                          2⤵
                                                                                            PID:3844
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:64
                                                                                              3⤵
                                                                                                PID:1584
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:32
                                                                                                3⤵
                                                                                                  PID:2808
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                cmd.exe
                                                                                                2⤵
                                                                                                  PID:1432
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:64
                                                                                                    3⤵
                                                                                                    • Checks for installed software on the system
                                                                                                    PID:3496
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:32
                                                                                                    3⤵
                                                                                                      PID:4112
                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                    cmd.exe
                                                                                                    2⤵
                                                                                                      PID:4132
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:64
                                                                                                        3⤵
                                                                                                          PID:4172
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:32
                                                                                                          3⤵
                                                                                                            PID:4192
                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                          cmd.exe
                                                                                                          2⤵
                                                                                                            PID:4212
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:64
                                                                                                              3⤵
                                                                                                              • Checks for installed software on the system
                                                                                                              PID:4248
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:32
                                                                                                              3⤵
                                                                                                                PID:4268
                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                              cmd.exe
                                                                                                              2⤵
                                                                                                                PID:4288
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:64
                                                                                                                  3⤵
                                                                                                                  • Checks for installed software on the system
                                                                                                                  PID:4324
                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4344
                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                  cmd.exe
                                                                                                                  2⤵
                                                                                                                    PID:4364
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:64
                                                                                                                      3⤵
                                                                                                                      • Checks for installed software on the system
                                                                                                                      PID:4400
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:4420
                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                      cmd.exe
                                                                                                                      2⤵
                                                                                                                        PID:4440
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:64
                                                                                                                          3⤵
                                                                                                                          • Checks for installed software on the system
                                                                                                                          PID:4476
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:4496
                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                          cmd.exe
                                                                                                                          2⤵
                                                                                                                            PID:4516
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:64
                                                                                                                              3⤵
                                                                                                                              • Checks for installed software on the system
                                                                                                                              PID:4552
                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4572
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              cmd.exe
                                                                                                                              2⤵
                                                                                                                                PID:4592
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:64
                                                                                                                                  3⤵
                                                                                                                                  • Checks for installed software on the system
                                                                                                                                  PID:4628
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:32
                                                                                                                                  3⤵
                                                                                                                                    PID:4648
                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                  cmd.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:4664
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:64
                                                                                                                                      3⤵
                                                                                                                                      • Checks for installed software on the system
                                                                                                                                      PID:4700
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:32
                                                                                                                                      3⤵
                                                                                                                                        PID:4728
                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                      cmd.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:4748
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:64
                                                                                                                                          3⤵
                                                                                                                                          • Checks for installed software on the system
                                                                                                                                          PID:4784
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:32
                                                                                                                                          3⤵
                                                                                                                                            PID:4804
                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                          cmd.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:4824
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:64
                                                                                                                                              3⤵
                                                                                                                                              • Checks for installed software on the system
                                                                                                                                              PID:4860
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:4880
                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                              cmd.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:4900
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                  • Checks for installed software on the system
                                                                                                                                                  PID:4936
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:32
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4956
                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                  cmd.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4972
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                      • Checks for installed software on the system
                                                                                                                                                      PID:5008
                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:32
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5036
                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                      cmd.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5056
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:64
                                                                                                                                                          3⤵
                                                                                                                                                          • Checks for installed software on the system
                                                                                                                                                          PID:5092
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:32
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5112
                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                          cmd.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4104
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:64
                                                                                                                                                              3⤵
                                                                                                                                                              • Checks for installed software on the system
                                                                                                                                                              PID:4140
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:32
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4200
                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                              cmd.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4220
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:64
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4272
                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:32
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Checks for installed software on the system
                                                                                                                                                                    PID:4304
                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                  cmd.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4352
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:64
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4404
                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:32
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4424
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        cmd.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4456
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:64
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4508
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:32
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4556
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              cmd.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4576
                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:64
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4640
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:32
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4648
                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4704
                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:64
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4756
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:32
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4796
                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4816
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:64
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4860
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:32
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4948
                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:64
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:32
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:64
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:32
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:64
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:32
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Checks for installed software on the system
                                                                                                                                                                                                                  PID:4340
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                    reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:64
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4424
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:32
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Checks for installed software on the system
                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:64
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                          reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:32
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Checks for installed software on the system
                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:64
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:32
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Checks for installed software on the system
                                                                                                                                                                                                                              PID:4944
                                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:64
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5040
                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                  reg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:32
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Checks for installed software on the system
                                                                                                                                                                                                                                  PID:5108

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\Users\Admin\.ntusernt.ini

                                                                                                                                                                                                                            • C:\Users\Admin\WSDUo\Desktop.ini

                                                                                                                                                                                                                            • C:\Users\Admin\WSDUo\rfIqA.class

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\zHSaWTaclw5098465862986235453.xml

                                                                                                                                                                                                                            • memory/64-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/380-37-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/472-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/492-104-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/492-123-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/628-35-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/748-91-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/748-60-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/752-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/792-97-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/856-36-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/996-85-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1164-38-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1168-96-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1192-109-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1192-117-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1316-110-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1368-86-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1400-112-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1428-41-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1432-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1556-90-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1584-126-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1584-122-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1604-120-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1620-84-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1660-43-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1716-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1748-87-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1756-63-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1828-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1828-95-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/1856-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2004-45-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2008-67-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2060-46-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2076-47-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2108-71-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2124-77-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2132-65-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2132-102-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2136-48-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2148-113-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2148-103-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2176-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2180-93-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2180-72-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2184-50-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2448-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2452-111-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2480-75-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2484-105-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2516-121-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2520-53-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2624-49-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2700-89-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2708-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2708-108-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2776-59-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2808-127-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/2840-79-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3348-81-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3348-116-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3388-115-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3452-62-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3496-57-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3496-129-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3496-119-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3568-61-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3592-80-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3640-83-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3640-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3708-34-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3844-124-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3848-106-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3936-92-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3976-99-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/3996-98-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4104-174-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4108-199-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4112-130-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4132-131-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4140-175-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4140-201-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4172-133-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4176-200-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4192-134-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4200-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4212-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4220-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4248-136-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4268-137-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4272-178-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4288-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4296-202-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4304-179-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4324-139-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4340-203-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4344-140-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4352-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4364-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4400-142-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4404-181-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4412-204-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4420-143-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4424-205-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4424-182-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4440-144-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4456-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4476-145-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4496-146-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4508-184-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4516-147-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4552-207-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4552-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4556-185-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4560-206-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4572-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4576-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4592-150-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4628-151-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4640-187-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4648-188-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4648-209-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4648-152-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4664-153-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4680-208-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4700-154-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4704-189-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4728-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4748-158-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4756-190-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4784-159-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4796-191-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4800-210-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4804-160-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4816-192-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4824-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4860-193-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4860-162-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4868-211-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4880-163-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4900-164-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4908-194-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4908-213-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4936-165-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4944-212-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4948-195-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4956-166-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/4972-167-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5008-197-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5008-168-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5016-196-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5036-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5040-214-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5056-171-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5064-198-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5092-172-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5108-215-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                            • memory/5112-173-0x0000000000000000-mapping.dmp